Aman-Mittal commented on issue #108: URL: https://github.com/apache/fineract-backoffice-ui/issues/108#issuecomment-5306478074
#368 closes three of this epic's four remaining sub-issues: #109 (permission guards on entity navigation hub screens), #112 (route guard with an Access Denied page), and — outside the epic — #142 and #367. **This epic stays open**, because #118 (`PermissionSummaryPipe`) is untouched. That is a display pipe turning a permission prefix into a human-readable capability summary; nothing in #368 needs it and inventing a use for it would have widened an already large PR. State after #368 lands: 11 of 12 sub-issues closed, #118 outstanding. One thing worth recording against the epic as a whole, because it changes what "permission-based navigation visibility" is worth: until #368, navigation visibility was the *only* thing permissions affected. Every screen the sidebar hid was still reachable by typing its URL (#367). The epic's sub-issues were all being satisfied honestly, but the property they were adding up to could not hold on its own — hiding an entry is a UX decision, not a control. Route authorization is now the thing being relied on, and the navigation agrees with it by a CI check (`scripts/check-route-permissions.mjs`) rather than by convention. Both remain defence-in-depth. Fineract Core is the authoritative security boundary, and #368's backend E2E spec signs in as a genuinely restricted user to demonstrate the platform refuses what the UI refused. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
