aya-abdallah-FOO opened a new pull request, #6197: URL: https://github.com/apache/fineract/pull/6197
## Description
When the **All** option is selected in the Office dropdown on the
Entity-to-Entity Mapping screen (System → Entity to Entity Mapping), the API
returns mappings across all offices
in the system, including branches the authenticated user has no access to.
This violates office-level access restrictions.
**Root cause:** `retrieveEntityToEntityMappings` treats `fromId = 0` (the
"All" sentinel) as a pass-through, so the SQL returns every row regardless of
the caller's office
hierarchy.
## Fix
When `fromId == 0` and the relation's `from_entity_type` is `1` (office),
a recursive CTE (`WITH RECURSIVE office_descendants`) scopes results to only
the authenticated user's
office and its descendants. Non-office relation types fall through to the
existing query unchanged.
## Testing
- A user in a non-root office sees only their office (and child offices)
in the Entity-to-Entity Mapping dropdown — not "All" or unrelated branches.
- `:fineract-provider:compileJava` and
`:fineract-provider:compileTestJava` pass clean
## Checklist
- [x] Single focused commit referencing `FINERACT-2720`
- [x] GPG-signed commit
- [x] Branch rebased on latest `develop`
- [x] No new dependencies introduced
FINERACT-2720
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
