rymghosn opened a new pull request, #6533: URL: https://github.com/apache/fineract/pull/6533
## Description JIRA: https://issues.apache.org/jira/browse/FINERACT-2870 The three read endpoints of `/v1/entitytoentitymapping` (`GET /`, `GET /{mapId}`, `GET /{mapId}/{fromId}/{toId}`) authorized with `validateHasReadPermission("FineractEntity")`, i.e. against `READ_FINERACTENTITY`. That permission is never seeded. The write side uses the `ENTITYMAPPING` entity (`CREATE_/UPDATE_/DELETE_ENTITYMAPPING` in `0002_initial_data.xml`), but there has never been a `READ_` counterpart under either name. As a result no role can be granted read access to entity mappings; only `ALL_FUNCTIONS` / `ALL_FUNCTIONS_READ` users can view them. This PR: - adds `FineractEntityApiResourceConstants.ENTITY_MAPPING_RESOURCE_NAME = "ENTITYMAPPING"` and uses it for the three read permission checks; - adds tenant changelog part `0255_add_read_entitymapping_permission.xml`, which seeds `READ_ENTITYMAPPING` (grouping `infrastructure`, like the other `ENTITYMAPPING` permissions) and is skipped if the row already exists. The validator keeps its existing resource name, so validation error codes are unchanged. No API change. ### Testing - New `FineractEntityApiResourceTest` (3 tests, one per read endpoint): fails on `develop`, passes with the fix. - Live on a local PostgreSQL instance booted with `bootRun`, as a user whose role holds only the `ENTITYMAPPING` permissions: - `develop` (`213f517b88`): all three GETs return 403 `User has no authority to READ fineractentitys`, and granting `READ_ENTITYMAPPING` fails with 404 `Permission with Code READ_ENTITYMAPPING does not exist`. - With this PR: the changeset runs and `READ_ENTITYMAPPING` exists; without it the role still gets 403 (`... READ entitymappings`); after granting it, all three GETs return 200. `mifos` (`ALL_FUNCTIONS`) is unaffected (200). - `spotlessJavaCheck` / `spotlessMiscCheck` pass. ## Checklist Please make sure these boxes are checked before submitting your pull request - thanks! - [x] Write the commit message as per [our guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests) - [x] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers. - [x] Create/update [unit or integration tests](https://fineract.apache.org/docs/current/#_testing) for verifying the changes made. - [x] Follow our [coding conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions). - [ ] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes (not applicable: no API change) - [x] [This PR must not be a "code dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit). Large changes can be made in a branch, with assistance. Ask for help on the [developer mailing list](https://fineract.apache.org/#contribute). - [x] If merging this PR resolves a JIRA issue, I will mark that issue as resolved and set "Fix Version/s" appropriately. - [x] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy). Your assigned reviewer(s) will follow our [guidelines for code reviews](https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
