ThevinuJ opened a new pull request, #6800: URL: https://github.com/apache/fineract/pull/6800
## Description Part of [FINERACT-2982](https://issues.apache.org/jira/browse/FINERACT-2982), follow-up to FINERACT-2639 (#6698). Activating a client that has a default savings product (`activateClient` → `openSavingsAccount` → `createActiveApplication`) opens an active savings account and posts its minimum opening balance. Client activation loaded the client with `findOneWithNotFoundDetection` and never checked the user's office, so a user from a sibling office could activate another office's client and trigger that deposit. ### Summary of Changes * New `ClientRepositoryWrapper.findOneInUserScope(clientId, loadLazyCollections)`. It is the same as the existing `getActiveClientInUserScope` without the "must be active" check, since the client is still pending at this point. * `ClientWritePlatformServiceJpaRepositoryImpl.activateClient` now loads the client through it. The check applies to every client activation, not only clients with a default savings product. * `savingsProductId` added to the `PostClientsRequest` Swagger model. The API already accepts it on create, but the generated clients could not send it, so the integration test could not create a client with a default savings product. ### Behaviour Change A non-head-office user can no longer activate a client outside their office hierarchy and gets 403 instead. Users in the client's office or a parent office, including head-office users, are unaffected. This may be worth a line in the release notes. ### Testing * **Unit:** new `ClientRepositoryWrapperTest` (in-scope client is returned, out-of-scope client is rejected). The existing `ClientWritePlatformServiceJpaRepositoryImplTest` passes. * **Integration (PostgreSQL):** new `ClientActivationOfficeHierarchyAccessIntegrationTest`. A pending client with a default savings product is created in one office: * A user from a sibling office, given `ACTIVATE_CLIENT` and `ACTIVATE_SAVINGSACCOUNT`, gets 403 with the `error.msg.not.authorized` code and the hierarchy message, and no savings account is opened. * A user from the client's office activates the client, and an active savings account of the default product is opened. * `:fineract-provider:cucumber`: 150/150 scenarios pass. ### Noticed While Working on This (not changed here) `createClient` with `active=true` and a default savings product also opens a funded savings account, and it doesn't check that the chosen office is in the user's hierarchy. Fixing it would stop branch users from creating clients in other offices, which is a wider change, so I left it out. Happy to add it here or in a separate ticket. ## Checklist - [x] Write the commit message as per [our guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests) - [x] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers. - [x] Create/update [unit or integration tests](https://fineract.apache.org/docs/current/#_testing) for verifying the changes made. - [x] Follow our [coding conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions). - [x] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes (`savingsProductId` added to the `PostClientsRequest` Swagger model; no change to API behaviour) - [x] [This PR must not be a "code dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit). Large changes can be made in a branch, with assistance. Ask for help on the [developer mailing list](https://fineract.apache.org/#contribute). - [x] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
