Aman-Mittal opened a new issue, #790:
URL: https://github.com/apache/fineract-backoffice-ui/issues/790
## Summary
The External Services screen configures **S3**, **SMTP** and
**Notification**, but not **SMS**, the message-gateway connection Fineract uses
to send SMS campaigns and notifications. SMS campaigns can be created in this
UI, but the gateway they depend on can only be configured through the API.
## Evidence (`main` @ `8da1086f`)
`src/app/features/system/external-services/external-services.component.ts:132`
sets `readonly serviceNames = ['S3', 'SMTP', 'NOTIFICATION'];`.
## Platform support
- `GET /v1/externalservice/SMS` and `PUT /v1/externalservice/SMS`. `SMS`
maps to the stored service `MESSAGE_GATEWAY`
(`ExternalServicesReadPlatformServiceImpl`,
`ExternalServicesPropertiesCommandFromApiJsonDeserializer`).
- Supported properties (`ExternalServicesConstants.SMSJSONinputParams`):
`host_name`, `port_number`, `end_point` and `tenant_app_key`.
## Proposed implementation
- Add `'SMS'` to `serviceNames`, with labelled fields for the four
properties: port numeric, and `tenant_app_key` as a password input.
- Never echo the stored app key back into the form in clear text. Show it as
"set" or "not set" and send it only when changed.
- Add a short help line linking the setting to SMS campaigns.
## RBAC
| Action | Permission code | Typically granted to |
|---|---|---|
| View external service settings | `READ_EXTERNALSERVICECONFIGURATION`,
derived by `AppUser.validateHasReadPermission("externalServiceConfiguration")`,
or `ALL_FUNCTIONS_READ` / `ALL_FUNCTIONS` | system administrators |
| Change settings | `UPDATE_EXTERNALSERVICES` | system administrators only |
- `UPDATE_EXTERNALSERVICES` is in `scripts/permission-codes.json`.
- The read code is computed at runtime and is not seeded in the snapshot. In
practice, only users with `ALL_FUNCTIONS_READ` or `ALL_FUNCTIONS` can load this
screen, and the UI should treat a 403 on load as "no access" rather than an
empty form.
- The gateway app key is a credential. Keep the screen restricted to
administrators, mask the key, and make sure it never appears in toasts or error
messages.
### UI expectations
- Keep the existing route guard.
- Gate Save on `UPDATE_EXTERNALSERVICES` with `[appRequiresPermission]`.
- A read-only user sees the values (with the key masked) but no enabled Save.
## Acceptance criteria
- [ ] SMS gateway settings can be viewed and saved, and SMS campaigns can
use the gateway.
- [ ] The app key is masked and only sent when changed.
- [ ] Save is gated on `UPDATE_EXTERNALSERVICES`, and a 403 on load is
handled.
- [ ] Unit tests cover the payload, the masking and the gating.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
