Aman-Mittal opened a new issue, #755: URL: https://github.com/apache/fineract-backoffice-ui/issues/755
### Summary **Security → Roles** and **Security → Users** support create and edit only. There's no way in the UI to disable a role, delete a role, or delete a user. Fineract supports all three. Today the only way to cut off a departed staff member is to edit their roles down to nothing, and a role created by mistake stays in every role picker indefinitely. ### Environment - App: https://aman-mittal.github.io/fineract-backoffice-ui (deployed `main`) - Backend: `sandbox.mifos.community`, tenant `default` - Role: superuser (`mifos`) - 2026-10-16 ### Preconditions A user-created role and user (this audit created role `E2E-AUDIT-20261016 Loan Officer` (id 3) and user `e2e_audit_loanofficer` (id 4)). ### Steps to reproduce 1. **Security → Roles**: each row offers only **Edit**. The edit page (`/security/roles/edit/3`) offers only Cancel and Save. 2. **Security → Users**: each row offers only **Edit**. The edit page (`/security/users/edit/4`) offers only Cancel and Save. ### Expected behavior - Roles: **Disable / Enable** (`POST /roles/{roleId}?command=disable|enable`) and **Delete** (`DELETE /roles/{roleId}`, which Fineract refuses while users hold the role, so that refusal needs a readable message). - Users: **Delete** (`DELETE /users/{userId}`), with confirmation. - Each gated on `DISABLE_ROLE`, `ENABLE_ROLE`, `DELETE_ROLE` and `DELETE_USER`. ### Actual behavior None of these actions exist. `api-surface.json` contains none of `deleteRolesRoleId`, `postRolesRoleId` or `deleteUsersUserId`, and non-generated code doesn't reference those endpoints or permission codes. ### Evidence Live row and edit-page actions captured on both screens. Static diff of `public/api/fineract.json` against `api-surface.json`. ### Impact - **Access withdrawal.** For a core-banking back office, removing a leaver's access is a control requirement. Disabling the account (or role) is the auditable way to do it; editing roles down to nothing isn't. - **Clutter and mis-assignment.** Test or mistaken roles stay in the role picker on Create User with no way to remove them. - **Inconsistent RBAC lifecycle.** The app invests heavily in permission gating (route guards, the impact panel on the matrix), but the lifecycle stops at "create". ### Suggested investigation Add the actions to the existing list rows and edit pages, behind confirmation dialogs consistent with the permission-change confirmation already on the role matrix. Check the exact refusal Fineract returns when deleting a role that's still assigned, and show it plainly. ### Verification status Absence confirmed live and in source. The endpoints themselves weren't called by this audit. ### Related endpoints `POST /roles/{roleId}?command=enable|disable`, `DELETE /roles/{roleId}`, `DELETE /users/{userId}` ### Acceptance criteria - A role can be disabled, re-enabled and (when unassigned) deleted from the UI. A disabled role is visibly marked and can't be picked for new users. - A user can be deleted from the UI after confirmation. - All actions are hidden or disabled without the matching permission. ### Related issues #492 (password self-service), #693 (role matrix save). **Audit test data that can't be removed through the UI for this reason:** role id 3 `E2E-AUDIT-20261016 Loan Officer`, user id 4 `e2e_audit_loanofficer` on `sandbox.mifos.community`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
