[GH] (ofbiz-framework/fix/party-role-validation-invoice-billing-finaccount): Workflow run "CodeQL" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "CodeQL" on ofbiz-framework.git/fix/party-role-validation-invoice-billing-finaccount has failed.
Run started by GitHub user karthikchundi-commits (triggered by karthikchundi-commits).

Head commit for run:
37cd732e1c5566939fc15bd8b003e9ecdda95341 / Karth <ka...@gmail.com>
Reject party/role combinations the party does not hold (OFBIZ-12370, OFBIZ-12372, OFBIZ-12373)

InvoiceRole, BillingAccountRole, and FinAccountRole all let a user submit
any partyId + roleTypeId combination with no validation that the party
actually holds that role. For InvoiceRole this hits the InvoiceRole/
PartyRole foreign key constraint and surfaces a raw SQL error. For
BillingAccountRole and FinAccountRole, an unconditional ensurePartyRole
eca instead silently fabricates a PartyRole record for the submitted
roleTypeId, regardless of whether it makes sense for that party.

Adds a small, reusable checkPartyRoleExists service (party component,
mirroring the existing ensureNaPartyRole helper) that looks up PartyRole
by (partyId, roleTypeId) and, if missing, fails with the same
PartyRoleAssociationRequired message already used for this exact class of
bug in createWorkEffortAndPartyAssign. Wires it as an in-validate eca on
createInvoiceRole, createBillingAccountRole, and createFinAccountRole, so
invalid combinations are rejected before the existing invoke-event
ensurePartyRole ecas ever run.

Adds regression tests: a negative case per ticket proving the
party/role combination is now rejected (and, for BillingAccountRole/
FinAccountRole, that no PartyRole is fabricated), plus a new
AutoAcctgBillingAccountTests suite since BillingAccountRole had no
existing test coverage.

Signed-off-by: Karth <ka...@gmail.com>

Report URL: https://github.com/apache/ofbiz-framework/actions/runs/36128475403

With regards,
GitHub Actions via GitBox