Thevinu Jayasekara created FINERACT-3027:
--------------------------------------------
Summary: Interest pause create/update/delete APIs check
non-existent permission READ_UPDATE LOAN
Key: FINERACT-3027
URL: https://issues.apache.org/jira/browse/FINERACT-3027
Project: Apache Fineract
Issue Type: Bug
Components: Loan
Reporter: Thevinu Jayasekara
Problem
LoanInterestPauseApiResource checks validateHasReadPermission("UPDATE LOAN")
before it creates, updates or deletes an interest pause, by loan id or by loan
external id. This resolves to the permission code READ_UPDATE LOAN, which does
not exist. As a result, only users with ALL_FUNCTIONS or ALL_FUNCTIONS_READ can
use these endpoints.
Steps to reproduce
1. Create a role with READ_LOAN and CREATE_INTEREST_PAUSE, and a user with that
role.
2. As that user, call POST /v1/loans/\{loanId}/interest-pauses on an active
progressive loan.
3. Response: 403, "User has no authority to READ update loans".
Expected
A user with READ_LOAN and the matching CREATE_INTEREST_PAUSE /
UPDATE_INTEREST_PAUSE / DELETE_INTEREST_PAUSE permission can manage interest
pauses.
Proposed fix
Check READ_LOAN in these endpoints, as the retrieve endpoints already do. The
command pipeline already enforces the *_INTEREST_PAUSE permission for the write
itself. Add an integration test with a role that has only these permissions.
Context
Found while working on FINERACT-2982
(https://github.com/apache/fineract/pull/6798), where the integration test
currently grants ALL_FUNCTIONS_READ to work around it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
