Aman-Mittal opened a new issue, #751: URL: https://github.com/apache/fineract-backoffice-ui/issues/751
### Summary A restricted user is shown four sidebar entries whose data Fineract then refuses with 403. The screens don't send the user to the Access Denied page the app already has. Two of them render the refusal as an **empty list**, so a restricted user is told there is no data rather than that they can't see it. ### Environment - App: https://aman-mittal.github.io/fineract-backoffice-ui (deployed `main`) - Backend: `sandbox.mifos.community`, tenant `default` - Role under test: custom role holding exactly `READ_CLIENT, READ_LOAN, CREATE_LOAN, READ_LOANPRODUCT, REPAYMENT_LOAN, READ_OFFICE, READ_STAFF` - Chrome 1440×900, 2026-10-16 ### Preconditions A role with the seven codes above (created through **Security → Roles**), assigned to a user created through **Security → Users**. ### Steps to reproduce 1. Sign in as that user. 2. Open each of these from the sidebar (or by URL): - `/products/collateral-management` - `/organization/group-levels` - `/products/interest-rate-charts` - `/spm/survey-responses` ### Expected behavior For each screen, one of: - it isn't in the sidebar, and the route sends the user to `/forbidden?required=…` like `/security/users` already does for this role; or - if it is reachable, a refused load is reported as a permission problem, never as an empty dataset. ### Actual behavior | Screen | Request | Status | What the user sees | |---|---|---|---| | Collateral Management | `GET /collateral-management` | **403** | Table with **"No records found."** | | Group Levels | `GET /grouplevels` | **403** | Table with **"No records found."** | | Interest Rate Charts | `GET /recurringdepositproducts` | **403** | "This list could not be loaded. TRY AGAIN" (retrying can only fail again) | | Survey Responses | `GET /survey` | **403** | An apparently usable "Load responses / Submit New Response (JSON)" form | For comparison, the guard is right elsewhere in the same session: `/security/users`, `/security/roles`, `/products/savings`, `/products/savings-accounts`, `/accounting/journal-entries` and `/system/codes` all land on `/forbidden?required=<CODE>` with a clear message. ### Evidence Network log from the restricted session (status and path only, no headers): ``` 403 GET /collateral-management 403 GET /grouplevels 403 GET /recurringdepositproducts 403 GET /survey ``` The other sidebar entries this role sees (Share Products, Share Accounts, SPM Surveys, Tellers, Asset Owners) loaded with **200**, so they aren't part of this issue. ### Impact - The "No records found" cases are the serious ones. A user who can't read collateral types or group levels concludes the institution has none configured. That's the same silent-failure class #696 and #693 describe: the UI behaves as if the answer were "nothing", so nobody reports it. - It breaks the promise in `DOCS/RBAC.md` that a user is not led into a screen whose requests will 403. ### Suggested investigation - Compare the `requiredPermissions` / route `data.permissions` for these four entries with the codes the platform enforces on their first request: `READ_COLLATERAL_PRODUCT` (or whatever the catalogue names for `/collateral-management`), `READ_GROUP` / group-level read, `READ_RECURRINGDEPOSITPRODUCT` / `READ_FIXEDDEPOSITPRODUCT` for the chart list's product lookup, and `READ_SURVEY`. They're probably declared unrestricted, or gated on a code that doesn't match. - Separately, check how list components handle a 403. Collateral Management and Group Levels seem to catch the error into an empty array. ### Verification status Reproduced in a live session with a role and user created through the UI for this audit (`E2E-AUDIT-20261016 Loan Officer`). ### Related endpoints `GET /collateral-management`, `GET /grouplevels`, `GET /recurringdepositproducts`, `GET /survey`, `GET /roles/{id}/permissions` ### Acceptance criteria - With the role above, none of the four entries appears in the sidebar, or each route redirects to `/forbidden` naming the missing code. - No list screen renders "No records found." for a 403. A refused load shows a permission message. - A regression test (role-based e2e, like the existing `rbac-*` specs) covers at least Collateral Management and Group Levels. ### Related issues #142 and #110 (sidebar gating), #696 and #691 (gates naming the wrong code), #666 (offices scope). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
