marta-jankovics commented on code in PR #4542:
URL: https://github.com/apache/fineract/pull/4542#discussion_r2055172290
##########
fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java:
##########
@@ -111,6 +120,9 @@ public CommandSource findCommandSource(CommandWrapper
wrapper, String idempotenc
public CommandSource getInitialCommandSource(CommandWrapper wrapper,
JsonCommand jsonCommand, AppUser maker, String idempotencyKey) {
CommandSource commandSourceResult =
CommandSource.fullEntryFrom(wrapper, jsonCommand, maker, idempotencyKey,
UNDER_PROCESSING.getValue());
+ if
(!configurationDomainService.isReplayable(wrapper.taskPermissionName())) {
Review Comment:
isReplayable is needed to mark the command not repayable. Since the command
was sanitized, it does not contain the original data. I think it is an
important information for the auditors, testers and also for the maker-checker
workflows not to enable it.
The permissions are loaded anyway with the
configurationDomainService.isMakerCheckerEnabledForTask if the global
configuration maker-checker is enabled.
Could you please make sure, that you add permissions for the newly
implemented actions!? We found again a missing one:
DEACTIVATEOVERDUE_LOANCHARGE (added with this PR).
Anyway now as we implemented the per-property sanitization, I can move the
flag from the permission to the command itself. So I've removed the
is_replayable and added is_sanitized. And I throw explicit exception if someone
tries to run maker-checker with a sanitized command.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
