Aman-Mittal commented on code in PR #822:
URL:
https://github.com/apache/fineract-backoffice-ui/pull/822#discussion_r4385330150
##########
src/app/features/clients/client-view.component.ts:
##########
@@ -256,6 +256,7 @@ export type ClientTab = (typeof CLIENT_TAB)[keyof typeof
CLIENT_TAB];
'ASSIGNSTAFF_CLIENT',
'UNASSIGNSTAFF_CLIENT',
'UPDATESAVINGSACCOUNT_CLIENT',
+ 'READ_CLIENTCHARGE',
Review Comment:
`READ_CLIENTCHARGE` was added to the Actions trigger's any-of list, but no
collateral code was. Once the item is gated, please add
`'READ_CLIENT_COLLATERAL_PRODUCT'` here too. Otherwise a user whose only
relevant permission is collateral-read finds the whole Actions button disabled
and can't reach the link.
Optional, same area: New Account now offers Share Account, but the empty
Shares tab still has no creation action, unlike Loans and Savings. A
`CREATE_SHAREACCOUNT`-gated empty-state button would make it consistent.
##########
src/app/features/clients/client-view.component.ts:
##########
@@ -441,6 +442,23 @@ export type ClientTab = (typeof CLIENT_TAB)[keyof typeof
CLIENT_TAB];
<ion-label>{{ 'ACTIONS.UNDO_WITHDRAW_CLIENT' |
appTranslate }}</ion-label>
</ion-item>
}
+ <ion-item
+ button
+ (click)="onViewCharges()"
+ data-testid="client-charges-action"
+ appRequiresPermission="READ_CLIENTCHARGE"
+ >
+ <ion-icon slot="start" name="receipt-outline"></ion-icon>
+ <ion-label>{{ 'CLIENT_CHARGES.TITLE' | appTranslate
}}</ion-label>
+ </ion-item>
+ <ion-item
+ button
+ (click)="onViewCollateral()"
Review Comment:
**Please gate this item.** Every other entry in this menu has
`appRequiresPermission`, but Collateral doesn't. Fineract only allows `GET
/clients/{id}/collaterals` with `ALL_FUNCTIONS`, `ALL_FUNCTIONS_READ` or
`READ_CLIENT_COLLATERAL_PRODUCT` (`SecurityConfig`; the entity is
`CLIENT_COLLATERAL_PRODUCT` for backwards compatibility).
So a teller with, say, `READ_CLIENT` + `ACTIVATE_CLIENT` sees an enabled
"Collateral" item and lands on a page whose list call returns 403.
```html
<ion-item button (click)="onViewCollateral()"
data-testid="client-collateral-action"
appRequiresPermission="READ_CLIENT_COLLATERAL_PRODUCT">
```
The `/clients/:clientId/collaterals` route also has no `permissionGuard`.
That gap already exists, but `data: { permissions:
'READ_CLIENT_COLLATERAL_PRODUCT' }` there would close the deep-link path too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
