ThevinuJ opened a new pull request, #6807:
URL: https://github.com/apache/fineract/pull/6807
## Description
The create, update and delete interest pause endpoints in
`LoanInterestPauseApiResource` called `validateHasReadPermission("UPDATE
LOAN")`. That builds the permission code `READ_UPDATE LOAN`, which doesn't
exist. So only users with `ALL_FUNCTIONS` or `ALL_FUNCTIONS_READ` could manage
interest pauses. A role given `CREATE/UPDATE/DELETE_INTEREST_PAUSE` was
rejected with "User has no authority to READ update loans".
**Change:** the six write endpoints (by loan id and by external loan id) now
check `READ_LOAN`, the same as the two retrieve endpoints. The write permission
itself is still enforced by the command pipeline (`CREATE_INTEREST_PAUSE`,
`UPDATE_INTEREST_PAUSE`, `DELETE_INTEREST_PAUSE`), so nothing gets looser. The
unused `MODIFY_RESOURCE_NAME_FOR_PERMISSIONS` constant is removed.
**Tests:** new `LoanInterestPausePermissionIntegrationTest`:
- A user with `READ_LOAN` + `CREATE/UPDATE/DELETE_INTEREST_PAUSE` (no
`ALL_FUNCTIONS_READ`) can create, update and delete an interest pause.
- A user with only `READ_LOAN` gets 403 `error.msg.not.authorized` naming
`CREATE_INTEREST_PAUSE`.
Verified locally against the PostgreSQL docker stack:
- Without the fix: both new tests fail with "User has no authority to READ
update loans".
- With the fix: the 2 new tests and all 33 tests in
`LoanInterestPauseApiTest` pass.
## Checklist
- [x] Write the commit message as per [our
guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests)
- [x] Acknowledge that we will not review PRs that are not passing the build
_("green")_ - it is your responsibility to get a proposed PR to pass the build,
not primarily the project's maintainers.
- [x] Create/update [unit or integration
tests](https://fineract.apache.org/docs/current/#_testing) for verifying the
changes made.
- [x] Follow our [coding
conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions).
- [ ] Add required Swagger annotation and update API documentation at
fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with
details of any API changes
- [x] [This PR must not be a "code
dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit).
Large changes can be made in a branch, with assistance. Ask for help on the
[developer mailing list](https://fineract.apache.org/#contribute).
- [x] If merging this PR resolves a JIRA issue, I will mark that issue as
resolved and set "Fix Version/s" appropriately.
- [x] I followed the [AI
Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
