KRYSTALM7 opened a new pull request, #66: URL: https://github.com/apache/fineract-loan-origination/pull/66
## Summary Addresses all critical and high security findings from code review . Covers LOS backend authorization gaps, mock service exposure, JWT secret hardening, credential externalization, and frontend CI enforcement. JIRA: https://issues.apache.org/jira/browse/FINERACT-2442 ## Changes ### Authorization Gaps Closed - Added `@PreAuthorize("hasRole('STAFF')")` to all approval and disbursement endpoints (`ApprovalController`, `DisbursementController`) and to staff-only operations in `LoanApplicationController` (`start-review`, `staff-detail`) - Added `@PreAuthorize("hasRole('ADMIN')")` to `AdminCustomerController#register` — matches the pattern already in `AdminStaffController` - `@EnableMethodSecurity` was already present; these annotations are active immediately ### Mock Services Gated to dev/test Only - `MockCustomerIdentityService` — added `@Profile({"dev","test"})`. Was an unconditional `@Service`, meaning hardcoded credentials (`customer1/password1`, `customer2/password2`) were active in all environments including production - `MockFineractAdapter` — removed `"default"` from `@Profile`. Was silently swallowing disbursements in any deployment that didn't set `spring.profiles.active=prod` ### JWT Secret Fail-fast - Added `JwtSecretValidator` — a `@Component @Profile("!dev & !test")` that fails startup with a clear error if the JWT secret is one of the two known-insecure defaults or shorter than 32 characters - App will now refuse to boot outside dev/test with a weak signing key ### Hardcoded Credentials Moved to Env Vars - `application.yml`: `password: somepassword` → `${SPRING_SECURITY_USER_PASSWORD:somepassword}` - `application.yml`: `password: sujan2003` → `${DB_PASSWORD:sujan2003}` - Dev defaults preserved; production deployments must supply env vars ### CORS Configuration - Added `CorsConfig` — explicit CORS policy replacing implicit defaults - Restricts allowed origins, methods, and headers for production safety ### Frontend Wired into CI - New `frontend` job in `ci.yml` (runs parallel with `build`): `npm ci` → `npm run lint` → `npm run format:check` - Frontend was previously never built, linted, or format-checked in CI ## What is NOT in this PR - Cross-tenant isolation fix (`tenantId` claim not propagated to `CustomerPrincipal`) — tracked separately - Controller-level security integration tests — tracked separately ## Checklist - [ ] I have read the Apache Fineract Contributing Guidelines. - [ ] My pull request is linked to the correct JIRA ticket. - [ ] My commit message follows the `FINERACT-<issue-no>: <description>` format. - [ ] I have added or updated tests where appropriate. - [ ] I have verified that the project builds successfully. ### Build & Tests ```bash ./mvnw clean verify ``` - All existing tests pass - Spotless formatting checks pass -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
