Enforce same-user maker-checker restriction

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/cashier/transaction-entry/transaction-entry.component.ts

@@ -6041,7 +6041,12 @@ export class TransactionEntryComponent implements OnInit, OnDestroy {
           this.editRequest = req;
         }
 
-        const acTyp = 'SD';
+        // Same bug, same fix as the token-driven withdrawal-slip lookup above (see its comment): the
+        // request carries its own real account_type (SAVINGS, CURRENT, FIXED_DEPOSIT or
+        // RECURRING_DEPOSIT), and hardcoding 'SD' here searched every non-savings account on the
+        // wrong endpoint, so reviewing a Current-account withdrawal always failed with "Account not
+        // found".
+        const acTyp = TransactionEntryComponent.SEARCH_ACCOUNT_TYPE_TO_AC_TYP[req.account_type || ''] || 'SD';
         const row = this.rows[0];
         row.acNo = req.account_no ?? '';
         row.acTyp = acTyp;

src/app/clients/client-stepper/client-kyc-step/client-kyc-step.component.html

@@ -1321,6 +1321,11 @@
           kycForm.get('kycDocumentNumber')?.hasError('pattern') && kycForm.get('kycDocumentNumber')?.touched
         ) {
           <mat-error>Only letters, numbers, hyphens and slashes allowed</mat-error>
+        } @else if (
+          kycForm.get('kycDocumentNumber')?.hasError('aadhaarLast4Mismatch') &&
+          kycForm.get('kycDocumentNumber')?.touched
+        ) {
+          <mat-error>Last 4 digits do not match the Aadhaar number entered above</mat-error>
         }
       </mat-form-field>
 

src/app/clients/client-stepper/client-kyc-step/client-kyc-step.component.ts

@@ -8,7 +8,14 @@
 
 import { Component, Input, OnInit, OnChanges, OnDestroy, SimpleChanges, inject } from '@angular/core';
 import { forkJoin, catchError, of } from 'rxjs';
-import { UntypedFormBuilder, UntypedFormGroup, Validators, FormsModule } from '@angular/forms';
+import {
+  UntypedFormBuilder,
+  UntypedFormGroup,
+  Validators,
+  FormsModule,
+  AbstractControl,
+  ValidationErrors
+} from '@angular/forms';
 import {
   MatDialog,
   MAT_DIALOG_DATA,
@@ -567,6 +574,28 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
   /** Existing signature document ID (for re-upload/delete) */
   existingSignatureDocId: string = '';
 
+  /**
+   * Cross-field check for the OVD "Document Number" field (kycDocumentNumber): when Aadhaar Card
+   * is the selected KYC document, its value must identify the same Aadhaar as the aadhaarNumber
+   * field captured earlier in this step - the last 4 digits are what's compared, since
+   * aadhaarNumber may hold either the raw 12-digit number or a masked value (masking only ever
+   * obscures the first 8 digits - see aadhaarMasked in the kycData getter below - so the last 4
+   * characters are always the real digits either way). Not applicable to any other document type,
+   * where kycDocumentNumber is unrelated to Aadhaar entirely.
+   */
+  private aadhaarLast4MatchValidator = (control: AbstractControl): ValidationErrors | null => {
+    if (this.selectedKycDoc?.code !== 'AADHAAR') {
+      return null;
+    }
+    const docNumber = (control.value || '').toString().trim();
+    const aadhaarValue = (control.parent?.get('aadhaarNumber')?.value || '').toString().trim();
+    if (docNumber.length < 4 || aadhaarValue.length < 4) {
+      // Required/pattern validators already flag an empty or too-short value on their own.
+      return null;
+    }
+    return docNumber.slice(-4) === aadhaarValue.slice(-4) ? null : { aadhaarLast4Mismatch: true };
+  };
+
   /** KYC Form */
   kycForm: UntypedFormGroup = this.formBuilder.group({
     hasPan: [true],
@@ -616,7 +645,8 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
       [
         Validators.required,
         Validators.pattern(/^[A-Za-z0-9\-\/\s]+$/),
-        Validators.maxLength(30)
+        Validators.maxLength(30),
+        this.aadhaarLast4MatchValidator
       ]
     ],
     kycDocIssueDate: [''],
@@ -739,6 +769,14 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
       this.kycForm.get('ecgcSalFlag')?.disable();
       this.kycForm.get('dormantFlag')?.disable();
     }
+
+    // aadhaarLast4MatchValidator (on kycDocumentNumber) reads this control's value directly rather
+    // than through its own valueChanges, so a re-check has to be triggered explicitly whenever the
+    // Aadhaar field itself changes - otherwise fixing aadhaarNumber after kycDocumentNumber was
+    // already entered would leave a stale mismatch error in place.
+    this.kycForm.get('aadhaarNumber')?.valueChanges.subscribe(() => {
+      this.kycForm.get('kycDocumentNumber')?.updateValueAndValidity({ onlySelf: true });
+    });
   }
 
   /** Seed the document-type picker from defaults (entity RBI docs vs. individual OVDs,
@@ -1009,6 +1047,9 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
     // Reset uploads + merged preview when document type changes
     this.kycDocFiles = { front: null, back: null };
     this.kycDocMergedPreview = null;
+    // aadhaarLast4MatchValidator only applies while Aadhaar Card is selected - re-check so switching
+    // to/away from it immediately picks up (or clears) the mismatch error.
+    this.kycForm.get('kycDocumentNumber')?.updateValueAndValidity({ onlySelf: true });
   }
 
   isKycDocSelected(proof: ProofType): boolean {
@@ -1189,6 +1230,9 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
           // Sync chip-picker selection with the prefilled document name
           if (data.kycDocumentName) {
             this.selectedKycDoc = this.findKycDocProofByName(data.kycDocumentName);
+            // patchValue above ran kycDocumentNumber's validators before selectedKycDoc was known,
+            // so aadhaarLast4MatchValidator needs a fresh check now that it is.
+            this.kycForm.get('kycDocumentNumber')?.updateValueAndValidity({ onlySelf: true });
           }
           // Set verification statuses from existing data
           if (data.panVerified) {

src/app/current-accounts/current-account-view/passbook-tab/passbook-tab.component.html

@@ -54,8 +54,8 @@
           <mat-icon>account_balance</mat-icon>
         </div>
         <div class="bank-name-block">
-          <div class="bank-title">LincPay Co-operative Bank Ltd.</div>
+          <div class="bank-title">{{ bankName }}</div>
-          <div class="bank-subtitle">Current Account Statement</div>
+          <div class="bank-subtitle">{{ bankSubtitle }}</div>
         </div>
       </div>
       <div class="statement-label">
@@ -64,6 +64,25 @@
       </div>
     </div>
 
+    <!-- Branch line — IFSC/MICR are how a UCB customer identifies which branch issued this, and are
+         needed for NEFT/RTGS/cheque printing, so a real passbook always carries them. -->
+    @if (branchName || ifscCode || micrCode) {
+      <div class="branch-line">
+        @if (branchName) {
+          <span>{{ branchName }} Branch</span>
+        }
+        @if (branchAddress) {
+          <span>{{ branchAddress }}</span>
+        }
+        @if (ifscCode) {
+          <span>IFSC: {{ ifscCode }}</span>
+        }
+        @if (micrCode) {
+          <span>MICR: {{ micrCode }}</span>
+        }
+      </div>
+    }
+
     <!-- Account Details -->
     <div class="account-details-band">
       <div class="account-details-grid">

src/app/current-accounts/current-account-view/passbook-tab/passbook-tab.component.scss

@@ -127,6 +127,18 @@ $header-text: #fff;
   }
 }
 
+// ─── Branch Identification Line ──────────────────────────────────────────────
+.branch-line {
+  background: #e8edf5;
+  border-bottom: 1px solid $border-color;
+  padding: 6px 24px;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px 18px;
+  font-size: 11px;
+  color: #4a5a7a;
+}
+
 // ─── Account Details Band ────────────────────────────────────────────────────
 .account-details-band {
   background: #f0f3f9;

src/app/current-accounts/current-account-view/passbook-tab/passbook-tab.component.ts

@@ -11,11 +11,12 @@ import { Component, OnInit, OnDestroy, inject, ElementRef, ViewChild } from '@an
 import { ActivatedRoute } from '@angular/router';
 import { UntypedFormBuilder } from '@angular/forms';
 import { CurrencyPipe } from '@angular/common';
-import { Subject, takeUntil } from 'rxjs';
+import { Subject, takeUntil, catchError, forkJoin, of } from 'rxjs';
 
 /** Custom Services */
 import { SettingsService } from 'app/settings/settings.service';
 import { Dates } from 'app/core/utils/dates';
+import { OrganizationService } from '../../../organization/organization.service';
 import { Currency } from 'app/shared/models/general.model';
 import {
   CurrentAccountTransaction,
@@ -44,6 +45,7 @@ export class PassbookTabComponent implements OnInit, OnDestroy {
   private formBuilder = inject(UntypedFormBuilder);
   private settingsService = inject(SettingsService);
   private dateUtils = inject(Dates);
+  private organizationService = inject(OrganizationService);
 
   private destroy$ = new Subject<void>();
 
@@ -60,6 +62,17 @@ export class PassbookTabComponent implements OnInit, OnDestroy {
   availableBalance: number = 0;
   activatedOnDate: any = null;
 
+  /** Bank/branch letterhead — real values from Institution Profile + Branch Profile (Organization
+   *  module) rather than a hardcoded name, so a printed passbook actually identifies which bank and
+   *  branch issued it, the way a real UCB's core banking system does. Falls back to a generic label
+   *  if the profile was never filled in, rather than showing a fabricated bank name. */
+  bankName = 'Bank';
+  bankSubtitle = 'Current Account Statement';
+  branchName = '';
+  branchAddress = '';
+  ifscCode = '';
+  micrCode = '';
+
   /** Transactions */
   allTransactions: CurrentAccountTransaction[] = [];
   filteredTransactions: CurrentAccountTransaction[] = [];
@@ -92,6 +105,33 @@ export class PassbookTabComponent implements OnInit, OnDestroy {
       fromDate: [''],
       toDate: ['']
     });
+
+    this.loadLetterhead();
+  }
+
+  /** Institution Profile is the bank's own single record; Branch Profile is per-office. There is no
+   *  office id on the current account data reaching this tab, and this deployment runs a single
+   *  branch, so the first branch profile on record is the correct one here — a genuinely
+   *  multi-branch deployment would need the account's own office id threaded through instead. */
+  private loadLetterhead(): void {
+    forkJoin({
+      institution: this.organizationService.getInstitutionProfile().pipe(catchError(() => of(null))),
+      branches: this.organizationService.getBranchProfiles().pipe(catchError(() => of([])))
+    }).subscribe(({ institution, branches }: any) => {
+      if (institution) {
+        this.bankName = institution.passbookHeaderName || institution.bankName || institution.legalName || 'Bank';
+        this.bankSubtitle = institution.licenseNumber
+          ? `Lic. No. ${institution.licenseNumber}`
+          : 'Current Account Statement';
+      }
+      const branch = Array.isArray(branches) ? branches[0] : null;
+      if (branch) {
+        this.branchName = branch.officeName || '';
+        this.branchAddress = branch.address || '';
+        this.ifscCode = branch.ifscCode || '';
+        this.micrCode = branch.micrCode || '';
+      }
+    });
   }
 
   private computeRunningBalances(transactions: CurrentAccountTransaction[]): CurrentAccountTransaction[] {
@@ -279,6 +319,18 @@ export class PassbookTabComponent implements OnInit, OnDestroy {
       margin-top: 3px;
     }
 
+    /* Branch identification line */
+    .branch-line {
+      background: #e8edf5;
+      border-bottom: 1px solid #d0d7e3;
+      padding: 5px 20px;
+      display: flex;
+      flex-wrap: wrap;
+      gap: 4px 16px;
+      font-size: 9.5px;
+      color: #4a5a7a;
+    }
+
     /* Account details band */
     .account-details-band {
       background: #f0f3f9;

src/assets/env.js

@@ -20,8 +20,8 @@
   // Tenants the login screen offers, and which one it starts on. Every identifier here has to exist
   // in the tenants table of the tenant-store database, or the platform rejects the request as an
   // unknown tenant.
-  window["env"]["fineractPlatformTenantId"] = 'lincpay';
+  window["env"]["fineractPlatformTenantId"] = 'utkarshbank';
-  window["env"]["fineractPlatformTenantIds"] = 'lincpay';
+  window["env"]["fineractPlatformTenantIds"] = 'utkarshbank';
 
   window['env']['tenantLogoUrl'] = '';
   window['env']['tenantLogoUrlDark'] = '';

src/environments/environment.prod.ts

@@ -19,8 +19,8 @@ export const environment = {
   version: env.mifos_x.version,
   hash: env.mifos_x.hash,
   // For connecting to server running elsewhere update the tenant identifier
-  fineractPlatformTenantId: loadedEnv['fineractPlatformTenantId'] || 'lincpay',
+  fineractPlatformTenantId: loadedEnv['fineractPlatformTenantId'] || 'utkarshbank',
-  fineractPlatformTenantIds: loadedEnv['fineractPlatformTenantIds'] || 'lincpay',
+  fineractPlatformTenantIds: loadedEnv['fineractPlatformTenantIds'] || 'utkarshbank',
   // For connecting to others servers running elsewhere update the base API URL
   baseApiUrls:
     loadedEnv['fineractApiUrls'] || 'https://demo.mifos.community,https://localhost:8443,' + window.location.origin,

src/environments/environment.ts

@@ -22,8 +22,8 @@ export const environment = {
   version: env.mifos_x.version,
   hash: env.mifos_x.hash,
   // For connecting to server running elsewhere update the tenant identifier
-  fineractPlatformTenantId: loadedEnv.fineractPlatformTenantId || 'lincpay',
+  fineractPlatformTenantId: loadedEnv.fineractPlatformTenantId || 'utkarshbank',
-  fineractPlatformTenantIds: loadedEnv.fineractPlatformTenantIds || 'lincpay',
+  fineractPlatformTenantIds: loadedEnv.fineractPlatformTenantIds || 'utkarshbank',
   // For connecting to others servers running elsewhere update the base API URL
   baseApiUrls:
     loadedEnv.fineractApiUrls || 'https://demo.mifos.community,https://localhost:8443,' + window.location.origin,