[PR] feat(auth): sign in through an OpenID Connect identity provider [fineract-backoffice-ui]

["guymoyo (via GitHub)" <gi...@apache.org>]

guymoyo opened a new pull request, #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818

   ## What and why
   
   Adds an opt-in "Sign in with your identity provider" path to the login page: authorization-code flow with PKCE (S256) as a public client, driven by an `oidc` block in `config.json` (`oidcLoginEnabled`, `oidc.issuer`, `oidc.clientId`, `oidc.scopes`, `passwordLoginEnabled`). Without those keys the login page is unchanged, and password login stays on unless a deployment turns it off (which is ignored unless OIDC is fully configured). No new dependency; `offline_access` is never requested.
   
   The UI loads the user context from `GET /v1/userdetails` with the Bearer token and maps it to the same session a Basic login produces, so menus, guards and `rbacEnabled` work unchanged. **Platform note:** in Fineract 1.15.0 that endpoint is only loaded with `fineract.security.oauth2.enabled`, so with OIDC federation (`fineract.security.oidc-federation.enabled`) alone it answers 404. Fineract needs a change to also load it under the federation flag; that upstream work is tracked separately (Jira to be filed). The UI does not fail open: on a 404 it drops the tokens, opens no session and shows a clear message on the callback page.
   
   `DOCS/OIDC.md` documents the config keys, the Keycloak client settings (public client, PKCE S256, exact redirect URIs, no `offline_access`, audience mapper) and the userdetails requirement.
   
   Closes #370
   
   ## Verification
   
   - `npm ci`, `npm run lint` (0 errors, no change to the suppressions baseline), `npm run test:unit` (312 files, 2546 tests), `npm run build`, `npm run i18n:check`, `check:icons`, `check:a11y-names`, `check:route-permissions` all pass.
   - Mocked Playwright (`--project=mocked e2e/login.spec.ts e2e/oidc-login.spec.ts`) passes. The OIDC spec covers the config matrix (absent, wrong-typed or incomplete config shows nothing new), password form hiding, the full round trip against a mocked provider (discovery, PKCE S256 redirect, code exchange, Bearer `/v1/userdetails`), the 404 case, and a mismatched `state`.
   - Not run here: the `backend` Playwright project (`oidc-login-backend.spec.ts` was updated for the new behaviour but needs Docker).
   - Verified by hand end to end against Fineract 1.15.0 + Keycloak 26, with the platform change described above applied.
   
   ## Screenshots
   
   Available on request.
   
   ## Checklist
   
   - [x] I did not hand-edit generated files under `src/app/api/`.
   - [x] New component or service code uses the adapter boundary in `src/app/core/adapters/` instead of direct browser globals or imperative third-party APIs.
   - [x] User-facing strings use translation keys.
   - [x] I added or updated tests appropriate to this change, or explained why tests were not needed.
   - [x] UI workflow changes include suitable e2e coverage, including real-backend testing where relevant.
   - [x] Commits are signed — see [Commit Signing](CONTRIBUTING.md#commit-signing) in CONTRIBUTING.md.
   - [ ] I followed the [AI-assisted contributions guidance](CONTRIBUTING.md#ai-assisted-contributions).
   - [ ] If this adds a feature or changes a workflow, I raised it on
         [dev@fineract.apache.org](https://lists.apache.org/list.html?dev@fineract.apache.org) first —
         or it is a bug fix, refactor or test change, where that does not apply.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(auth): sign in through an OpenID Connect identity provider [fineract-backoffice-ui]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818#issuecomment-6273435395

   <!-- e2e-report-backend -->
   ### E2E — real Fineract
   ## 🎭 E2E Tests
   
   **✅ All green** — 171 passed · 0 failed · 0 skipped, across 50 spec files in 10m 54s.
   
   ### By spec file
   
   | Spec | ✅ | ❌ | ⏭️ | 🔒 | Time |
   | --- | ---: | ---: | ---: | ---: | ---: |
   | backend.setup.ts | 3 | 0 | 0 | 0 | 6.1s |
   | accounting-closure-backend.spec.ts | 2 | 0 | 0 | 0 | 12.8s |
   | batch-api-operations.spec.ts | 5 | 0 | 0 | 0 | 28.1s |
   | center-servicing.spec.ts | 2 | 0 | 0 | 0 | 17.4s |
   | charge-servicing-backend.spec.ts | 6 | 0 | 0 | 0 | 30.3s |
   | client-legal-form-search.spec.ts | 1 | 0 | 0 | 0 | 5.3s |
   | client-transfer.spec.ts | 4 | 0 | 0 | 0 | 48.7s |
   | collection-sheet.spec.ts | 1 | 0 | 0 | 0 | 6.2s |
   | deposit-account-servicing.spec.ts | 3 | 0 | 0 | 0 | 25.9s |
   | deposit-lifecycle-backend.spec.ts | 4 | 0 | 0 | 0 | 23.6s |
   | deposit-product-configuration.spec.ts | 3 | 0 | 0 | 0 | 18.0s |
   | double-submit-backend.spec.ts | 2 | 0 | 0 | 0 | 12.3s |
   | form-layout-reflow.spec.ts | 6 | 0 | 0 | 0 | 35.0s |
   | group-membership.spec.ts | 3 | 0 | 0 | 0 | 48.1s |
   | loan-account-actions.spec.ts | 3 | 0 | 0 | 0 | 25.3s |
   | loan-approved-amount-revision.spec.ts | 3 | 0 | 0 | 0 | 18.0s |
   | loan-charge-off.spec.ts | 2 | 0 | 0 | 0 | 18.5s |
   | loan-flows-non-admin-roles.spec.ts | 8 | 0 | 0 | 0 | 1m 37s |
   | loan-product-accounting.spec.ts | 1 | 0 | 0 | 0 | 31.1s |
   | loan-repayment-gating.spec.ts | 2 | 0 | 0 | 0 | 8.8s |
   | loan-servicing-rbac-backend.spec.ts | 4 | 0 | 0 | 0 | 11.1s |
   | loan-servicing.spec.ts | 2 | 0 | 0 | 0 | 17.7s |
   | login.spec.ts | 4 | 0 | 0 | 0 | 5.2s |
   | oidc-login-backend.spec.ts | 2 | 0 | 0 | 0 | 3.9s |
   | parity-screens.spec.ts | 8 | 0 | 0 | 0 | 43.0s |
   | rbac-backend-restricted-user.spec.ts | 7 | 0 | 0 | 0 | 33.6s |
   | rbac-dead-end-controls.spec.ts | 7 | 0 | 0 | 0 | 32.2s |
   | rbac-disabled-flag-backend.spec.ts | 6 | 0 | 0 | 0 | 26.2s |
   | rbac-multi-permission.spec.ts | 9 | 0 | 0 | 0 | 54.8s |
   | rbac-office-scoped-user.spec.ts | 6 | 0 | 0 | 0 | 26.3s |
   | bulk-import-entity-types.spec.ts | 1 | 0 | 0 | 0 | 10.3s |
   | delinquency-configuration.spec.ts | 2 | 0 | 0 | 0 | 18.6s |
   | full-demo.spec.ts | 1 | 0 | 0 | 0 | 58.1s |
   | interest-rate-charts.spec.ts | 1 | 0 | 0 | 0 | 7.7s |
   | loan-lifecycle.spec.ts | 4 | 0 | 0 | 0 | 1m 60s |
   | loan-schedule-type.spec.ts | 3 | 0 | 0 | 0 | 32.6s |
   | rbac-permissionless-user.spec.ts | 4 | 0 | 0 | 0 | 21.0s |
   | report-mailing-job.spec.ts | 3 | 0 | 0 | 0 | 18.7s |
   | report-parameter-backend.spec.ts | 4 | 0 | 0 | 0 | 22.4s |
   | savings-flows-non-admin-roles.spec.ts | 7 | 0 | 0 | 0 | 1m 39s |
   | savings-transaction-correction.spec.ts | 1 | 0 | 0 | 0 | 6.1s |
   | savings-transaction-gating.spec.ts | 2 | 0 | 0 | 0 | 6.8s |
   | share-account-servicing.spec.ts | 2 | 0 | 0 | 0 | 17.8s |
   | share-product-accounting.spec.ts | 1 | 0 | 0 | 0 | 25.1s |
   | teller-cash-management.spec.ts | 2 | 0 | 0 | 0 | 38.0s |
   | tenant-date-defaults-backend.spec.ts | 1 | 0 | 0 | 0 | 7.0s |
   | working-capital-loan-actions-backend.spec.ts | 3 | 0 | 0 | 0 | 21.5s |
   | working-capital-product-accounting-backend.spec.ts | 2 | 0 | 0 | 0 | 21.3s |
   | working-capital-rbac-backend.spec.ts | 2 | 0 | 0 | 0 | 7.7s |
   | working-capital-servicing-backend.spec.ts | 6 | 0 | 0 | 0 | 36.4s |
   
   <details>
   <summary><b>All 171 tests</b> — click to expand</summary>
   
   **`backend.setup.ts`**
   
   - ✅ seed backend reference data — `2.0s`
   - ✅ seed backend reference data — `1.9s`
   - ✅ seed backend reference data — `2.2s`
   
   **`accounting-closure-backend.spec.ts`**
   
   - ✅ Accounting closures against Fineract › a closed period reads as Closed, and the platform refuses a posting inside it — `6.9s`
   - ✅ Accounting closures against Fineract › the form keeps the user on the page and names the reason when Fineract refuses — `5.8s`
   
   **`batch-api-operations.spec.ts`**
   
   - ✅ Batch API Operations against Fineract › runs the sample batch scenario — create client, create loan, add and read back a charge — `5.4s`
   - ✅ Batch API Operations against Fineract › shows a parse error instead of submitting when the batch input is not valid JSON — `8.0s`
   - ✅ Batch API enclosingTransaction semantics against Fineract › rolls back the earlier steps when enclosingTransaction is true and a later step fails — `5.0s`
   - ✅ Batch API enclosingTransaction semantics against Fineract › does not roll back the earlier steps when enclosingTransaction is false and a later step fails — `4.9s`
   - ✅ Batch API Operations on a mobile viewport against Fineract › the sample batch scenario is reachable and works by touch at mobile width — `4.9s`
   
   **`center-servicing.spec.ts`**
   
   - ✅ Center servicing › a center is activated, staffed and given a group — `12.3s`
   - ✅ Center servicing › notes are recorded against the center — `5.1s`
   
   **`charge-servicing-backend.spec.ts`**
   
   - ✅ loan charge servicing › waives a loan charge, and the platform records the waiver — `6.3s`
   - ✅ loan charge servicing › cannot reverse a waiver: the platform answers 500, not a business rule — `700ms`
   - ✅ loan charge servicing › offers no Pay on a charge the platform will not let be paid — `4.8s`
   - ✅ loan charge servicing › adjusts a loan charge to a smaller amount — `5.7s`
   - ✅ savings charge servicing › pays a savings charge with the amount and due date the platform demands — `6.4s`
   - ✅ savings charge servicing › carries an active flag, which is what gates Inactivate — `6.3s`
   
   **`client-legal-form-search.spec.ts`**
   
   - ✅ Client list: legal form filtering › an entity client appears in the main client list — `5.3s`
   
   **`client-transfer.spec.ts`**
   
   - ✅ Client transfer between offices › a proposed transfer is held until the destination accepts, and then the client moves — `12.6s`
   - ✅ Client transfer between offices › a rejected transfer leaves the client on hold, and withdrawing is the way back — `13.1s`
   - ✅ Client transfer between offices › a client can be transferred in one step when the user may act for both offices — `11.4s`
   - ✅ Client staff assignment › an officer can be assigned and then removed — `11.6s`
   
   **`collection-sheet.spec.ts`**
   
   - ✅ Collection Sheet › scopes staff to the office, sends the choice, and reports an empty sheet — `6.2s`
   
   **`deposit-account-servicing.spec.ts`**
   
   - ✅ Term deposit account servicing › an account is approved, activated and closed before maturity — `11.4s`
   - ✅ Term deposit account servicing › a deposit is recorded, listed, and reversed without leaving the list — `8.2s`
   - ✅ Term deposit account servicing › an application can be rejected instead of approved — `6.3s`
   
   **`deposit-lifecycle-backend.spec.ts`**
   
   - ✅ fixed deposit products › carry the rate the user typed, not a hidden default — `5.0s`
   - ✅ an active fixed deposit account › shows its balance and maturity figures — `5.5s`
   - ✅ an active fixed deposit account › can be closed into the client savings account — `7.1s`
   - ✅ an active fixed deposit account › can have a charge added to it — `6.1s`
   
   **`deposit-product-configuration.spec.ts`**
   
   - ✅ Deposit product configuration › a fixed deposit product survives being edited — `6.1s`
   - ✅ Deposit product configuration › a recurring deposit product can be created at all — `5.8s`
   - ✅ Deposit product configuration › a savings product carries its accounting configuration — `6.2s`
   
   **`double-submit-backend.spec.ts`**
   
   - ✅ A double-click submits once › a repayment is recorded once, not twice — `6.0s`
   - ✅ A double-click submits once › a client is created once, not twice — `6.2s`
   
   **`form-layout-reflow.spec.ts`**
   
   - ✅ form layout at the narrow viewport › Create GL Account gives every field a usable width at 320px — `5.3s`
   - ✅ form layout at the narrow viewport › Create Loan gives every field a usable width at 320px — `5.1s`
   - ✅ form layout at the narrow viewport › Create Office gives every field a usable width at 320px — `5.6s`
   - ✅ form layout at the narrow viewport › Create Staff gives every field a usable width at 320px — `4.9s`
   - ✅ form layout at the narrow viewport › no page-level horizontal scroll at 320px — `9.1s`
   - ✅ form layout at the wide viewport › Create GL Account still uses more than one column at 1280px — `5.0s`
   
   **`group-membership.spec.ts`**
   
   - ✅ Group membership and lifecycle › a group is activated, staffed, given members and a committee, then emptied — `20.4s`
   - ✅ Group membership and lifecycle › notes are recorded against the group and can be removed again — `8.5s`
   - ✅ Group membership and lifecycle › an empty group is closed with a reason, and a group with members is refused — `19.2s`
   
   **`loan-account-actions.spec.ts`**
   
   - ✅ Loan account lifecycle actions › new action menu items appear only for active loans — `7.3s`
   - ✅ Loan account lifecycle actions › undo disbursal shows a confirm dialog and reverts the loan to Approved — `9.5s`
   - ✅ Loan account lifecycle actions › write off requires confirmation and moves the loan out of Active status — `8.5s`
   
   **`loan-approved-amount-revision.spec.ts`**
   
   - ✅ Loan approved and available-disbursement amount revision › revises the approved amount on an active, partially-disbursed loan — `6.4s`
   - ✅ Loan approved and available-disbursement amount revision › revises the available disbursement amount, which also changes the approved amount — `6.0s`
   - ✅ Loan approved and available-disbursement amount revision › shows the platform’s own refusal, not a generic validation message — `5.6s`
   
   **`loan-charge-off.spec.ts`**
   
   - ✅ Loan servicing commands › charges a loan off through the UI and reverses it — `10.0s`
   - ✅ Loan servicing commands › records a goodwill credit through the shared transaction form — `8.5s`
   
   **`loan-flows-non-admin-roles.spec.ts`**
   
   - ✅ a loan taken through four separated duties, every account built in the UI › an administrator builds the four roles and accounts through the forms — `36.0s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the officer books the application and is not offered approval of their own loan — `14.7s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the approver, differing from the officer in one code, is offered it and approves — `5.4s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the approver is not offered disbursement of the loan they just approved — `4.5s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the disburser, holding only DISBURSE_LOAN, completes the payout end to end — `7.0s`
   - ✅ a loan taken through four separated duties, every account built in the UI › and the same route now refuses an UPDATE_LOAN holder, as the platform does — `7.3s`
   - ✅ a loan taken through four separated duties, every account built in the UI › a command with no mapped code is left to the platform rather than guessed at — `4.9s`
   - ✅ a loan taken through four separated duties, every account built in the UI › a repayment duty reaches its own form, and records a repayment — `16.7s`
   
   **`loan-product-accounting.spec.ts`**
   
   - ✅ Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger — `31.1s`
   
   **`loan-repayment-gating.spec.ts`**
   
   - ✅ Repayment is offered only where the platform allows it › withheld on a loan awaiting approval, offered once it is active — `8.4s`
   - ✅ Repayment is offered only where the platform allows it › the platform refuses a repayment on a loan awaiting approval — `384ms`
   
   **`loan-servicing-rbac-backend.spec.ts`**
   
   - ✅ loan servicing and charge command permissions, on the platform › each command is authorised by the code the UI declares for it — `5.2s`
   - ✅ loan servicing and charge command permissions, on the platform › no portfolio write code authorises any of its entity commands — `5.6s`
   - ✅ loan servicing and charge command permissions, on the platform › the deferred-income adjustments are not commands at loan level — `160ms`
   - ✅ loan servicing and charge command permissions, on the platform › the deferred-income adjustments are commands on one transaction — `178ms`
   
   **`loan-servicing.spec.ts`**
   
   - ✅ Loan servicing: notes and transaction adjustment › notes can be added and removed, with a confirm dialog on delete — `7.7s`
   - ✅ Loan servicing: notes and transaction adjustment › a repayment transaction can be viewed and adjusted with a corrected amount — `10.1s`
   
   **`login.spec.ts`**
   
   - ✅ Login › login page displays correctly — `1.3s`
   - ✅ Login › login form has required fields — `1.3s`
   - ✅ Login › submit button is disabled when form is empty — `1.5s`
   - ✅ Login › submit button is enabled when form is filled — `1.1s`
   
   **`oidc-login-backend.spec.ts`**
   
   - ✅ identity-provider route against a real Fineract › is offered beside the password form, and an unreachable provider sends nothing to Fineract — `1.3s`
   - ✅ identity-provider route against a real Fineract › a real password sign-in still gets a session with the route offered — `2.6s`
   
   **`parity-screens.spec.ts`**
   
   - ✅ Screens added for platform parity › a manual journal entry can be read whole and reversed — `6.1s`
   - ✅ Screens added for platform parity › an entry that is already reversed is not offered again — `4.4s`
   - ✅ Screens added for platform parity › a report definition can be created, edited and deleted; a core one cannot — `5.4s`
   - ✅ Screens added for platform parity › a core report opens read-only with only its in-use setting — `4.1s`
   - ✅ Screens added for platform parity › a pending loan is approved from the queue, in a batch — `6.6s`
   - ✅ Screens added for platform parity › a fixed deposit is listed as a deposit, not as a savings account — `4.7s`
   - ✅ Screens added for platform parity › an office has a screen, and it carries its custom fields — `4.8s`
   - ✅ Screens added for platform parity › a savings account carries notes, and the note survives a reload — `6.9s`
   
   **`rbac-backend-restricted-user.spec.ts`**
   
   - ✅ a genuinely restricted Fineract user › holds exactly the permissions their role was granted — `260ms`
   - ✅ a genuinely restricted Fineract user › reaches the screen their permission covers — `4.8s`
   - ✅ a genuinely restricted Fineract user › is refused a screen their permission does not cover, by URL and by the backend — `4.5s`
   - ✅ a genuinely restricted Fineract user › is refused a write screen they can read the list for, and the write itself — `6.1s`
   - ✅ a genuinely restricted Fineract user › is not offered the actions it would be refused for — `4.0s`
   - ✅ a genuinely restricted Fineract user › is shown an action it cannot take, disabled and saying what it needs — `5.3s`
   - ✅ a genuinely restricted Fineract user › the superuser the rest of the suite uses is unaffected — `8.7s`
   
   **`rbac-dead-end-controls.spec.ts`**
   
   - ✅ a client's account tables › withhold the link, but not the number, from a user who cannot open the account — `4.9s`
   - ✅ a client's account tables › keep the link for a user who holds READ_LOAN — `5.4s`
   - ✅ the office transactions list › withholds Create from a reader, and the route refuses it too — `5.0s`
   - ✅ the office transactions list › offers Create to an administrator — `3.7s`
   - ✅ the office transactions list › refuses the list at the door for the code the platform does not check — `4.2s`
   - ✅ a group's member list › names the member without linking when the reader cannot open clients — `4.1s`
   - ✅ a group's member list › keeps the link for a reader who holds READ_CLIENT — `5.0s`
   
   **`rbac-disabled-flag-backend.spec.ts`**
   
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is shown the whole navigation, including modules their role does not cover — `2.7s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is admitted by the route guard to a screen their role does not cover — `7.5s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is still refused by Fineract, which the flag does not reach — `630ms`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is told the list is beyond their role, and not offered a retry that cannot succeed — `4.7s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › gets the same treatment on a second refused list, not a one-screen fix — `5.3s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › still loads the list their role does cover, with no failure state at all — `5.2s`
   
   **`rbac-multi-permission.spec.ts`**
   
   - ✅ a route declaring more than one permission code (OR semantics) › is admitted by either declared code alone — `4.9s`
   - ✅ a route declaring more than one permission code (OR semantics) › is admitted by the other declared code alone — `4.2s`
   - ✅ a route declaring more than one permission code (OR semantics) › is refused when holding neither declared code, by the router and by the backend — `4.6s`
   - ✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › reaches read screens across modules it holds no specific code for — `8.8s`
   - ✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › is refused every write screen, and the writes themselves — `7.1s`
   - ✅ a restricted session across a real page reload › keeps the same permission boundary after reloading, not just after a fresh login — `9.6s`
   - ✅ a second real action-level gate, distinct from loan repayment › is shown the Approve action disabled and naming what it needs, refused by the backend too — `5.1s`
   - ✅ Security module writes (users, roles), against the real backend › reaches the list screens but is refused the write screens — `10.4s`
   - ✅ Security module writes (users, roles), against the real backend › is refused creating a user and modifying a role, by the backend itself — `237ms`
   
   **`rbac-office-scoped-user.spec.ts`**
   
   - ✅ an account scoped to a branch office › differs from a head-office account in office alone, not in permissions — `334ms`
   - ✅ an account scoped to a branch office › is shown only its own office in the client list, and told which office it is in — `4.9s`
   - ✅ an account scoped to a branch office › sees a shorter list than an identically-permissioned head-office account — `4.8s`
   - ✅ an account scoped to a branch office › is refused another office’s client by the platform, and told so once — `5.1s`
   - ✅ an account scoped to a branch office › can still open the record that is in its own office — `4.3s`
   - ✅ an account scoped to a branch office › is not offered an edit it would be refused for on the Offices screen — `6.8s`
   
   **`bulk-import-entity-types.spec.ts`**
   
   - ✅ every offered entity type is one the platform accepts — `10.3s`
   
   **`delinquency-configuration.spec.ts`**
   
   - ✅ creates a delinquency range, then edits it — `9.3s`
   - ✅ creates a delinquency bucket from the ranges the template offers — `9.3s`
   
   **`full-demo.spec.ts`**
   
   - ✅ Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement — `58.1s`
   
   **`interest-rate-charts.spec.ts`**
   
   - ✅ lists charts without a server error — `7.7s`
   
   **`loan-lifecycle.spec.ts`**
   
   - ✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan — `31.4s`
   - ✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan — `31.5s`
   - ✅ Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval — `28.9s`
   - ✅ Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden — `27.7s`
   
   **`loan-schedule-type.spec.ts`**
   
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › loan products list shows a schedule type chip per product — `9.1s`
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › create a Progressive loan product end-to-end and verify it round-trips — `13.4s`
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › loan creation shows the schedule type badge for a Progressive product — `10.2s`
   
   **`rbac-permissionless-user.spec.ts`**
   
   - ✅ an account whose role grants nothing › is authenticated by Fineract and authorized by it for nothing — `770ms`
   - ✅ an account whose role grants nothing › is signed in and landed on a screen rather than stranded at the login form — `4.6s`
   - ✅ an account whose role grants nothing › is offered no permission-gated module, and refused each one by URL and by Fineract — `10.5s`
   - ✅ an account whose role grants nothing › is left a navigation whose entries actually work — `5.2s`
   
   **`report-mailing-job.spec.ts`**
   
   - ✅ report mailing job creation › is no longer refused for a missing parameter — `5.6s`
   - ✅ report mailing job creation › the payload carries the locale and the schedule — `5.6s`
   - ✅ report mailing job creation at the narrow viewport › every field is reachable and the job still saves at 320px — `7.6s`
   
   **`report-parameter-backend.spec.ts`**
   
   - ✅ Dynamic report parameters against Fineract › keeps the parameter form available when a report has cascading lookups — `4.4s`
   - ✅ Dynamic report parameters against Fineract › changing Office changes the Client Listing row set — `6.0s`
   - ✅ Cascading report parameters against Fineract › sends the parent value to the child lookup and clears the child when it changes — `7.2s`
   - ✅ Chart reports against Fineract › renders a chart report as a chart rather than a table — `4.7s`
   
   **`savings-flows-non-admin-roles.spec.ts`**
   
   - ✅ a savings account taken through four separated duties, every account built in the UI › an administrator builds the five roles and accounts through the forms — `48.8s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the officer books the application and is not offered approval of it — `8.6s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the approver, differing in one code, is offered it and approves — `4.5s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the activator activates, and cannot take a deposit — `5.7s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the teller, holding only the transaction codes, records a deposit end to end — `5.9s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the cash-withdrawal control asks for the cash code, not the application one — `19.0s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the transaction route refuses an UPDATE_SAVINGSACCOUNT holder, as the platform does — `6.6s`
   
   **`savings-transaction-correction.spec.ts`**
   
   - ✅ Savings transaction correction › a deposit is reversed and a hold is released — `6.1s`
   
   **`savings-transaction-gating.spec.ts`**
   
   - ✅ Savings transactions are offered only on an active account › withheld while awaiting approval, offered once active — `6.6s`
   - ✅ Savings transactions are offered only on an active account › the platform refuses a deposit on an account awaiting approval — `204ms`
   
   **`share-account-servicing.spec.ts`**
   
   - ✅ Share account servicing › an account is approved, activated, traded and closed — `12.0s`
   - ✅ Share account servicing › an application can be rejected — `5.9s`
   
   **`share-product-accounting.spec.ts`**
   
   - ✅ Share product accounting › a share product is mapped to equity and round-trips on edit — `25.1s`
   
   **`teller-cash-management.spec.ts`**
   
   - ✅ Teller cash management › a cashier is listed, receives an allocation, and settles cash back — `26.6s`
   - ✅ Teller cash management › settling more than the cashier holds is refused and the form stays usable — `11.4s`
   
   **`tenant-date-defaults-backend.spec.ts`**
   
   - ✅ Date defaults come from the platform, not the browser › a client can be created while the browser is a day ahead — `7.0s`
   
   **`working-capital-loan-actions-backend.spec.ts`**
   
   - ✅ Working Capital loan actions, against a real Fineract › charges off an active loan, and then offers only the undo — `8.1s`
   - ✅ Working Capital loan actions, against a real Fineract › credits the borrower with a goodwill credit, and the balance falls — `5.9s`
   - ✅ Working Capital loan actions, against a real Fineract › writes the loan off, which closes it and opens the recovery path — `7.4s`
   
   **`working-capital-product-accounting-backend.spec.ts`**
   
   - ✅ Working Capital product accounting, on the platform › configures the accrual rule and its twelve accounts, and the platform accepts it — `15.5s`
   - ✅ Working Capital product accounting, on the platform › prefills a configured product and re-saves it without blanking anything — `5.8s`
   
   **`working-capital-rbac-backend.spec.ts`**
   
   - ✅ Working Capital command permissions, on the platform › each command is authorised by the code the UI declares for it — `5.5s`
   - ✅ Working Capital command permissions, on the platform › UPDATE_WORKINGCAPITALLOAN authorises none of them — `2.3s`
   
   **`working-capital-servicing-backend.spec.ts`**
   
   - ✅ transaction corrections › undoes a repayment, and the platform marks it reversed — `5.5s`
   - ✅ transaction corrections › offers no correction on the disbursement, which the platform refuses by type — `5.6s`
   - ✅ transaction corrections › adjusts a repayment, which reverses it and books the new amount — `5.2s`
   - ✅ charge adjustment › adjusts a charge, and the outstanding amount follows — `5.2s`
   - ✅ custom datatables › adds, edits and deletes a row of a multi-row table on the loan — `7.2s`
   - ✅ custom datatables › creates a loan that a create-time check would otherwise refuse — `7.7s`
   
   </details>
   
   <details>
   <summary><b>Slowest 10</b> — what the shard counts should be tuned against</summary>
   
   | Test | Spec | Time |
   | --- | --- | ---: |
   | Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement | `full-demo.spec.ts` | 58.1s |
   | a savings account taken through four separated duties, every account built in the UI › an administrator builds the five roles and accounts through the forms | `savings-flows-non-admin-roles.spec.ts` | 48.8s |
   | a loan taken through four separated duties, every account built in the UI › an administrator builds the four roles and accounts through the forms | `loan-flows-non-admin-roles.spec.ts` | 36.0s |
   | Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan | `loan-lifecycle.spec.ts` | 31.5s |
   | Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan | `loan-lifecycle.spec.ts` | 31.4s |
   | Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger | `loan-product-accounting.spec.ts` | 31.1s |
   | Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval | `loan-lifecycle.spec.ts` | 28.9s |
   | Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden | `loan-lifecycle.spec.ts` | 27.7s |
   | Teller cash management › a cashier is listed, receives an allocation, and settles cash back | `teller-cash-management.spec.ts` | 26.6s |
   | Share product accounting › a share product is mapped to equity and round-trips on edit | `share-product-accounting.spec.ts` | 25.1s |
   
   </details>
   
   
   📼 [Download the HTML report, videos and traces](https://github.com/apache/fineract-backoffice-ui/actions/runs/39254700392) — see the `playwright-report-backend` artifact.
   
   <sub>Generated by [run 39254700392](https://github.com/apache/fineract-backoffice-ui/actions/runs/39254700392) from `71fd35a`. The run executed a fork branch, so treat its contents as unverified.</sub>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(auth): sign in through an OpenID Connect identity provider [fineract-backoffice-ui]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818#issuecomment-6277809411

   <!-- pr-sequence-diagram -->
   ### 🔄 What this change talks to
   
   From the 9 application TypeScript file(s) changed in this pull request.
   
   ```mermaid
   sequenceDiagram
     autonumber
     participant AuthService as AuthService (Service)
     participant STORAGE as STORAGE (Injected)
     participant ConfigService as ConfigService (Service)
     participant Injector as Injector (Injected)
     participant OidcService as OidcService (Injected)
     participant HttpClient as HttpClient (Injected)
     participant OidcError as OidcError (Service)
     participant LoginComponent as LoginComponent (Component)
     participant BrandingService as BrandingService (Injected)
     participant ThemeService as ThemeService (Injected)
     participant FormBuilder as FormBuilder (Injected)
     participant I18N as I18N (Injected)
     AuthService->>STORAGE: readRaw()
     AuthService->>ConfigService: config()
     AuthService->>Injector: get()
     AuthService->>OidcService: getAccessToken()
     AuthService->>OidcService: clear()
     AuthService->>OidcService: hasSession()
     AuthService->>OidcService: getIdToken()
     AuthService->>OidcService: endSession()
     AuthService->>HttpClient: post()
     AuthService->>STORAGE: clearScope()
     AuthService->>STORAGE: writeRaw()
     AuthService->>STORAGE: write()
     ConfigService->>STORAGE: write()
     OidcError->>ConfigService: oidcConfig()
     OidcError->>STORAGE: write()
     OidcError->>STORAGE: remove()
     LoginComponent->>BrandingService: appName()
     LoginComponent->>ThemeService: isDarkMode()
     LoginComponent->>BrandingService: logoDarkUrl()
     LoginComponent->>BrandingService: logoUrl()
     LoginComponent->>BrandingService: resolveLogo()
     LoginComponent->>ConfigService: config()
     LoginComponent->>FormBuilder: group()
     LoginComponent->>AuthService: currentTenantId()
     LoginComponent->>I18N: use()
     LoginComponent->>OidcService: startLogin()
     LoginComponent->>I18N: translate()
     LoginComponent->>ConfigService: setApiUrl()
     LoginComponent->>AuthService: login()
     LoginComponent->>AuthService: twoFactorPending()
   ```
   
   _Truncated for readability: 2 further participant(s) not shown._
   
   > Static analysis of `inject()` fields and the calls made on them — not an execution trace. It cannot see dynamic dispatch, and generated API clients under `src/app/api` are collapsed into the single `Fineract` participant.
   
   
   
   <sub>Generated by [run 39299377263](https://github.com/apache/fineract-backoffice-ui/actions/runs/39299377263) from `6e4bcc7`. The run executed a fork branch, so treat its contents as unverified.</sub>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(auth): sign in through an OpenID Connect identity provider [fineract-backoffice-ui]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818#issuecomment-6273434906

   <!-- e2e-report-mocked -->
   ### E2E — mocked backend
   ## 🎭 E2E Tests
   
   **✅ All green** — 431 passed · 0 failed · 1 skipped, across 40 spec files in 9m 55s.
   
   ### By spec file
   
   | Spec | ✅ | ❌ | ⏭️ | 🔒 | Time |
   | --- | ---: | ---: | ---: | ---: | ---: |
   | accessibility.spec.ts | 5 | 0 | 0 | 0 | 14.6s |
   | all-functions-read-shortcut.spec.ts | 5 | 0 | 0 | 0 | 7.4s |
   | branded-deployment.spec.ts | 9 | 0 | 0 | 0 | 13.1s |
   | breadcrumb.spec.ts | 2 | 0 | 0 | 0 | 3.9s |
   | client-date-picker-revisit.spec.ts | 1 | 0 | 0 | 0 | 6.2s |
   | client-servicing-gaps.spec.ts | 14 | 0 | 0 | 0 | 43.3s |
   | client.spec.ts | 1 | 0 | 0 | 0 | 3.0s |
   | collateral-currency-search.spec.ts | 5 | 0 | 0 | 0 | 13.1s |
   | date-picker-revisit.spec.ts | 6 | 0 | 0 | 0 | 18.2s |
   | deployment-customization.spec.ts | 19 | 0 | 0 | 0 | 26.4s |
   | deposit-product-edit.spec.ts | 2 | 0 | 0 | 0 | 4.6s |
   | e2e-journey.spec.ts | 81 | 0 | 0 | 0 | 2m 39s |
   | feature-coverage.spec.ts | 49 | 0 | 0 | 0 | 1m 55s |
   | functional-coverage.spec.ts | 42 | 0 | 0 | 0 | 2m 5s |
   | global-search-nav-shortcuts.spec.ts | 4 | 0 | 0 | 0 | 10.6s |
   | global-search-navigation.spec.ts | 8 | 0 | 0 | 0 | 22.3s |
   | group-detail.spec.ts | 8 | 0 | 0 | 0 | 35.4s |
   | guidance-tour.spec.ts | 5 | 0 | 1 | 0 | 14.9s |
   | keyboard-shortcuts.spec.ts | 5 | 0 | 0 | 0 | 11.6s |
   | list-load-failure.spec.ts | 5 | 0 | 0 | 0 | 18.8s |
   | list-pagination.spec.ts | 17 | 0 | 0 | 0 | 1m 11s |
   | loan-delinquency-actions.spec.ts | 11 | 0 | 0 | 0 | 45.9s |
   | loan-portfolio-summary.spec.ts | 4 | 0 | 0 | 0 | 15.8s |
   | loan-product-down-payment.spec.ts | 13 | 0 | 0 | 0 | 1m 1s |
   | loan-schedule-type-gating.spec.ts | 6 | 0 | 0 | 0 | 22.4s |
   | charge-refund.spec.ts | 1 | 0 | 0 | 0 | 6.2s |
   | client-accounts.spec.ts | 2 | 0 | 0 | 0 | 9.9s |
   | client-load-error.spec.ts | 2 | 0 | 0 | 0 | 7.4s |
   | contract-termination.spec.ts | 1 | 0 | 0 | 0 | 8.2s |
   | loan-servicing-gaps.spec.ts | 18 | 0 | 0 | 0 | 1m 8s |
   | logout-reason-notice.spec.ts | 4 | 0 | 0 | 0 | 3.0s |
   | oidc-login.spec.ts | 12 | 0 | 0 | 0 | 21.4s |
   | rbac-feature-flag.spec.ts | 11 | 0 | 0 | 0 | 20.8s |
   | rbac-route-protection.spec.ts | 18 | 0 | 0 | 0 | 1m 47s |
   | report-enhancements.spec.ts | 2 | 0 | 0 | 0 | 7.8s |
   | reporting.spec.ts | 2 | 0 | 0 | 0 | 4.4s |
   | scheduler-jobs.spec.ts | 3 | 0 | 0 | 0 | 12.2s |
   | sidebar-active-state.spec.ts | 1 | 0 | 0 | 0 | 1m 27s |
   | two-factor-authentication.spec.ts | 10 | 0 | 0 | 0 | 20.2s |
   | working-capital-loan-actions.spec.ts | 17 | 0 | 0 | 0 | 1m 16s |
   
   <details>
   <summary><b>All 432 tests</b> — click to expand</summary>
   
   **`accessibility.spec.ts`**
   
   - ✅ Runtime accessibility › client list has no blocking violations — `2.7s`
   - ✅ Runtime accessibility › client list links meet color contrast in dark mode — `2.7s`
   - ✅ Runtime accessibility › client form has no blocking violations — `3.2s`
   - ✅ Runtime accessibility › banner and dashboard content have no blocking violations — `2.7s`
   - ✅ Runtime accessibility › create office dialog has no blocking violations — `3.3s`
   
   **`all-functions-read-shortcut.spec.ts`**
   
   - ✅ ALL_FUNCTIONS_READ shortcut › grants read access to the Clients list without any explicit READ_CLIENT permission — `1.9s`
   - ✅ ALL_FUNCTIONS_READ shortcut › does not grant the Create Client action — `1.4s`
   - ✅ ALL_FUNCTIONS_READ shortcut › does not grant Create Client even combined with an explicit READ_CLIENT permission — `1.4s`
   - ✅ ALL_FUNCTIONS_READ shortcut › a user with the real CREATE_CLIENT permission still sees the button — `1.2s`
   - ✅ ALL_FUNCTIONS_READ shortcut › ALL_FUNCTIONS (full superuser) still sees the Create Client button — `1.4s`
   
   **`branded-deployment.spec.ts`**
   
   - ✅ a fully branded deployment › wears the institution’s name and mark, not Fineract’s — `1.4s`
   - ✅ a fully branded deployment › carries the institution’s palette into its own chrome and into Ionic — `1.4s`
   - ✅ a fully branded deployment › drops the sections the institution does not run — `1.3s`
   - ✅ a fully branded deployment › renames and reorders entries to the institution’s vocabulary — `1.4s`
   - ✅ a fully branded deployment › offers the institution’s own systems beside Fineract’s screens — `1.3s`
   - ✅ a fully branded deployment › restates the labels the institution words differently — `1.3s`
   - ✅ a fully branded deployment › keeps a readable palette in dark mode, with a label colour to match — `1.3s`
   - ✅ a fully branded deployment › does not leak a light colour into the dark palette — `1.4s`
   - ✅ a fully branded deployment › reports no configuration defects for the published example — `2.3s`
   
   **`breadcrumb.spec.ts`**
   
   - ✅ a single-crumb page shows no breadcrumb trail — `1.5s`
   - ✅ a nested page shows a trail, and the ancestor crumb navigates back — `2.4s`
   
   **`client-date-picker-revisit.spec.ts`**
   
   - ✅ Client form date pickers › stay usable on a second visit to the create form — `6.2s`
   
   **`client-servicing-gaps.spec.ts`**
   
   - ✅ Client transfers › proposing a transfer sends the destination, the date and the format that parses it — `3.5s`
   - ✅ Client transfers › a one-step transfer omits the date the platform refuses — `3.3s`
   - ✅ Client transfers › the client’s own office is not offered as a destination — `3.3s`
   - ✅ Client transfers › accepting a transfer sends a note and nothing else — `3.0s`
   - ✅ Client transfers › accepting with no note sends an empty body — `3.0s`
   - ✅ Client transfers › rejecting a transfer is offered while one is pending — `3.5s`
   - ✅ Client transfers › withdrawing is offered from on hold, which is the only way back — `3.0s`
   - ✅ Client transfers › answers to a transfer are not offered when none is pending — `2.3s`
   - ✅ Client staff and default savings account › assigning a member of staff sends the staff id — `3.7s`
   - ✅ Client staff and default savings account › unassigning echoes the current holder back, which the platform requires — `3.1s`
   - ✅ Client staff and default savings account › unassigning is not offered when nobody is assigned — `2.2s`
   - ✅ Client staff and default savings account › the assigned officer is shown on the header — `2.5s`
   - ✅ Client staff and default savings account › setting the default savings account sends the account id — `3.6s`
   - ✅ Undoing a rejection › posts the command name the platform recognises, not the menu identifier — `3.3s`
   
   **`client.spec.ts`**
   
   - ✅ Client Management › should create a new client — `3.0s`
   
   **`collateral-currency-search.spec.ts`**
   
   - ✅ Collateral product currency — searchable select (#​626) › the field is closed with no option list until it is opened — `2.5s`
   - ✅ Collateral product currency — searchable select (#​626) › typing narrows a long, alphabetical list to the matching currency — `2.9s`
   - ✅ Collateral product currency — searchable select (#​626) › matches by currency code as well as by name — `2.6s`
   - ✅ Collateral product currency — searchable select (#​626) › shows a "no results" message rather than an empty panel — `2.3s`
   - ✅ Collateral product currency — searchable select (#​626) › Cancel closes the picker without changing the selection — `2.9s`
   
   **`date-picker-revisit.spec.ts`**
   
   - ✅ Date pickers on revisited forms › office form keeps its pickers usable on every visit — `3.4s`
   - ✅ Date pickers on revisited forms › staff form keeps its pickers usable on every visit — `3.1s`
   - ✅ Date pickers on revisited forms › holiday form keeps its pickers usable on every visit — `3.0s`
   - ✅ Date pickers on revisited forms › teller form keeps its pickers usable on every visit — `2.8s`
   - ✅ Date pickers on revisited forms › accounting closure form keeps its pickers usable on every visit — `2.8s`
   - ✅ Date pickers on revisited forms › floating rate form keeps its pickers usable on every visit — `3.1s`
   
   **`deployment-customization.spec.ts`**
   
   - ✅ with no overlay mounted › boots, keeps the shipped branding, and shows the full menu — `1.2s`
   - ✅ with no overlay mounted › does not ask for an overlay this deployment has not declared — `1.7s`
   - ✅ with no overlay mounted › logs no federation parse error on load — `1.2s`
   - ✅ branding › applies colour and density tokens to the document — `1.2s`
   - ✅ branding › recolours Ionic through the same tokens — `1.2s`
   - ✅ branding › renames the product in the header and the tab title — `2.2s`
   - ✅ branding › serves the deployment logo and names it after the deployment — `1.8s`
   - ✅ branding › refuses a fill that cannot carry the white text baked into the stylesheet — `1.3s`
   - ✅ branding › accepts a light accent and derives a dark label for it — `1.3s`
   - ✅ branding › ignores a token outside the published allow-list, and says so — `1.2s`
   - ✅ navigation › hides an entry named by its id — `1.2s`
   - ✅ navigation › does not hide an entry named by its labelKey — `1.3s`
   - ✅ navigation › renames and reorders entries — `1.8s`
   - ✅ navigation › adds an external entry that opens in a new tab — `1.4s`
   - ✅ navigation › nests an added entry under an existing group — `1.3s`
   - ✅ navigation › gates an added entry on permissions like any built-in one — `1.3s`
   - ✅ navigation › drops an external entry with no usable url rather than rendering a dead link — `1.2s`
   - ✅ layering › merges over config.json instead of replacing it — `1.2s`
   - ✅ layering › a malformed overlay leaves the application usable — `1.3s`
   
   **`deposit-product-edit.spec.ts`**
   
   - ✅ Editing a deposit product keeps what it was not asked to change › a fixed deposit product keeps its deposit amount, accounting and rate chart on save — `2.3s`
   - ✅ Editing a deposit product keeps what it was not asked to change › a recurring deposit product keeps its deposit amount, accounting and rate chart on save — `2.4s`
   
   **`e2e-journey.spec.ts`**
   
   - ✅ E2E: Login Flow › should display login page with all required fields — `1.1s`
   - ✅ E2E: Login Flow › should have Sign In button disabled when fields are empty — `1.2s`
   - ✅ E2E: Login Flow › should enable Sign In when credentials are entered — `1.0s`
   - ✅ E2E: Login Flow › should redirect to dashboard after successful login — `1.3s`
   - ✅ E2E: Login Flow › should display language selector on login page — `1.1s`
   - ✅ E2E: Login Flow › should display API endpoint selector with value — `1.1s`
   - ✅ E2E: Dashboard › should display dashboard summary cards — `1.3s`
   - ✅ E2E: Dashboard › should display system health as Online — `1.5s`
   - ✅ E2E: Dashboard › should display pending approvals section — `1.2s`
   - ✅ E2E: Dashboard › should display loan and savings status distribution charts — `1.3s`
   - ✅ E2E: Dashboard › should display system operational status — `1.3s`
   - ✅ E2E: Dashboard › should have header with business date, render time, and logout — `1.3s`
   - ✅ E2E: Dashboard › should have sidebar toggle button — `1.3s`
   - ✅ E2E: Dashboard › should have global search bar in header — `1.3s`
   - ✅ E2E: Dashboard › should have Guide button in header — `1.3s`
   - ✅ E2E: Dashboard › should have dark mode toggle button — `1.4s`
   - ✅ E2E: Sidebar Navigation › should have all main navigation links — `1.3s`
   - ✅ E2E: Sidebar Navigation › should have Products section with sub-links — `1.3s`
   - ✅ E2E: Sidebar Navigation › should have Transfers section with sub-links — `1.3s`
   - ✅ E2E: Sidebar Navigation › should have Accounting section with sub-links — `1.4s`
   - ✅ E2E: Sidebar Navigation › should have Security section — `1.4s`
   - ✅ E2E: Sidebar Navigation › should have Settings section — `1.4s`
   - ✅ E2E: Sidebar Navigation › should have Organization section — `1.3s`
   - ✅ E2E: Sidebar Navigation › should have System section — `1.4s`
   - ✅ E2E: Sidebar Navigation › should navigate to all major pages via sidebar — `2.8s`
   - ✅ E2E: Offices › should display offices list with table — `1.6s`
   - ✅ E2E: Offices › should have Create Office button — `1.5s`
   - ✅ E2E: Offices › should navigate to office create form — `1.7s`
   - ✅ E2E: Offices › should validate office create form - save disabled when empty — `1.6s`
   - ✅ E2E: Offices › should fill office create form and enable save — `2.2s`
   - ✅ E2E: Offices › should cancel office creation and return to list — `1.6s`
   - ✅ E2E: Offices › should have search input on offices page — `1.4s`
   - ✅ E2E: Offices › should show edit button for each office — `1.4s`
   - ✅ E2E: Offices › should have pagination controls — `1.4s`
   - ✅ E2E: Clients › should display clients list page — `1.4s`
   - ✅ E2E: Clients › should display client data in table — `1.6s`
   - ✅ E2E: Clients › should show ACTIVE status badge — `1.4s`
   - ✅ E2E: Clients › should have Create Client button — `1.6s`
   - ✅ E2E: Clients › should show empty state when no clients exist — `1.5s`
   - ✅ E2E: Clients › should have search input and status filter — `1.9s`
   - ✅ E2E: Clients › should have pagination controls — `2.1s`
   - ✅ E2E: Client Creation › should navigate to client create form — `2.8s`
   - ✅ E2E: Client Creation › should display all required client form fields, across the wizard steps — `3.6s`
   - ✅ E2E: Client Creation › should display optional client form fields, across the wizard steps — `3.2s`
   - ✅ E2E: Client Creation › should have Next disabled until the current step is valid — `3.0s`
   - ✅ E2E: Client Creation › should populate office dropdown from API — `2.8s`
   - ✅ E2E: Client Creation › should fill client form and enable save on the last step — `3.7s`
   - ✅ E2E: Client Creation › should submit client and redirect to the new client view — `4.1s`
   - ✅ E2E: Client Creation › should cancel client creation and return to clients list — `2.6s`
   - ✅ E2E: Client Creation › should have add office quick-action button — `2.3s`
   - ✅ E2E: Client Creation › should have help icons for form fields — `2.1s`
   - ✅ E2E: Client Creation › should have calendar buttons for date fields — `3.1s`
   - ✅ E2E: Client Creation › should have pre-filled dates in Submitted On and Activation Date — `3.2s`
   - ✅ E2E: Client Creation › should have Active checkbox checked by default — `2.2s`
   - ✅ E2E: Client Creation › should handle Entity legal form showing fullname field — `3.6s`
   - ✅ E2E: Loan Products Page › should display loan products list page — `2.3s`
   - ✅ E2E: Loan Products Page › should have Create Loan Product button — `2.4s`
   - ✅ E2E: Loan Products Page › should display table with correct headers — `2.3s`
   - ✅ E2E: Loan Products Page › should show empty state when no products exist — `1.9s`
   - ✅ E2E: Loan Products Page › should have search input — `1.9s`
   - ✅ E2E: Loan Products Page › should navigate to loan product create form — `2.6s`
   - ✅ E2E: Savings Products Page › should display savings products list page — `2.3s`
   - ✅ E2E: Other Products Pages › Fixed Deposit Products page loads — `2.4s`
   - ✅ E2E: Other Products Pages › Recurring Deposit Products page loads — `2.2s`
   - ✅ E2E: Other Products Pages › Share Products page loads — `2.3s`
   - ✅ E2E: Other Products Pages › Tax Components page loads — `2.4s`
   - ✅ E2E: Other Products Pages › Tax Groups page loads — `2.2s`
   - ✅ E2E: Other Products Pages › Floating Rates page loads — `2.3s`
   - ✅ E2E: Loans Portfolio › should display loans portfolio page — `2.4s`
   - ✅ E2E: Loans Portfolio › should have Create Loan Account button — `2.3s`
   - ✅ E2E: Loans Portfolio › should display table with correct headers — `2.4s`
   - ✅ E2E: Loans Portfolio › should show empty state when no loans exist — `2.3s`
   - ✅ E2E: Loans Portfolio › should have search input — `2.1s`
   - ✅ E2E: Loans Portfolio › should have pagination controls — `2.3s`
   - ✅ E2E: Header & Global Elements › should display Fineract logo and title in header — `2.1s`
   - ✅ E2E: Header & Global Elements › should display logged-in username — `2.1s`
   - ✅ E2E: Header & Global Elements › should display office name for user — `1.6s`
   - ✅ E2E: Header & Global Elements › should have Logout button — `2.1s`
   - ✅ E2E: Header & Global Elements › should have language selector in header — `1.9s`
   - ✅ E2E: Header & Global Elements › should display render time — `2.1s`
   - ✅ E2E: Header & Global Elements › should display business date — `2.1s`
   
   **`feature-coverage.spec.ts`**
   
   - ✅ Navigation & Sidebar › all main navigation links are visible in sidebar — `2.2s`
   - ✅ Navigation & Sidebar › sidebar navigation routes to correct pages — `3.5s`
   - ✅ Navigation & Sidebar › navigating to /accounting redirects to /accounting/chart-of-accounts — `3.5s`
   - ✅ Navigation & Sidebar › navigating to /organization redirects to /organization/offices — `3.5s`
   - ✅ Navigation & Sidebar › navigating to /system redirects to /system/data-tables — `3.3s`
   - ✅ Navigation & Sidebar › an unknown route keeps its URL and offers recovery actions — `3.0s`
   - ✅ Navigation & Sidebar › header shows logged-in user info — `2.0s`
   - ✅ Navigation & Sidebar › help tour button is visible and interactive — `1.6s`
   - ✅ Navigation & Sidebar › logout button is visible — `1.7s`
   - ✅ Navigation & Sidebar › language selector is present — `2.0s`
   - ✅ Dashboard › dashboard shows key metrics cards — `2.0s`
   - ✅ Dashboard › dashboard shows pending approvals section — `2.0s`
   - ✅ Dashboard › dashboard shows loan and savings status distribution — `2.0s`
   - ✅ Dashboard › dashboard shows system operational status — `2.1s`
   - ✅ Groups › groups page renders with title — `2.3s`
   - ✅ Groups › groups page has create button — `2.2s`
   - ✅ Centers › centers page renders with title — `2.3s`
   - ✅ Centers › centers page has create button — `2.3s`
   - ✅ Organization › offices page loads with list — `2.4s`
   - ✅ Organization › staff page loads — `2.4s`
   - ✅ Organization › funds page loads — `2.3s`
   - ✅ Organization › payment types page loads — `2.4s`
   - ✅ Accounting › chart of accounts loads — `2.4s`
   - ✅ Accounting › journal entries page loads — `2.5s`
   - ✅ Accounting › accounting closures loads — `1.9s`
   - ✅ Accounting › accounting rules loads — `1.9s`
   - ✅ Accounting › financial activity mappings loads — `2.2s`
   - ✅ Accounting › charges page loads — `2.3s`
   - ✅ Security › users page loads — `2.1s`
   - ✅ Security › roles page loads — `2.3s`
   - ✅ Security › audit logs page loads — `2.4s`
   - ✅ Security › leftover audit trails path lands on audits, not the dashboard — `3.5s`
   - ✅ Products - Loan & Savings › loan products page loads — `2.3s`
   - ✅ Products - Loan & Savings › savings products page loads — `2.3s`
   - ✅ Products - Loan & Savings › tax components page loads — `2.3s`
   - ✅ Products - Loan & Savings › tax groups page loads — `2.2s`
   - ✅ Products - Loan & Savings › floating rates page loads — `2.3s`
   - ✅ Products - Loan & Savings › savings accounts page loads — `2.4s`
   - ✅ Settings › global configurations page loads — `2.4s`
   - ✅ Settings › holidays page loads — `2.3s`
   - ✅ Settings › working days page loads — `2.3s`
   - ✅ System › data tables page loads — `2.1s`
   - ✅ System › bulk import page loads — `2.3s`
   - ✅ System › delinquency page loads — `2.1s`
   - ✅ Tellers › tellers page loads with create button — `2.3s`
   - ✅ Transfers › account transfer page loads — `2.4s`
   - ✅ Transfers › standing instructions page loads — `2.3s`
   - ✅ Transfers › SI history page loads — `2.3s`
   - ✅ Embedded Fintech › asset owners page loads — `1.9s`
   
   **`functional-coverage.spec.ts`**
   
   - ✅ Client CRUD Workflow › should complete full client creation flow — Person — `4.3s`
   - ✅ Client CRUD Workflow › should complete full client creation flow — Entity — `3.5s`
   - ✅ Client CRUD Workflow › should cancel client creation and return to list — `2.7s`
   - ✅ Client CRUD Workflow › should disable office and legal form in edit mode — `3.5s`
   - ✅ Client View & Status Transitions › should display client view with correct details — `3.3s`
   - ✅ Client View & Status Transitions › should show actions menu for pending client (status 100) — `3.3s`
   - ✅ Client View & Status Transitions › should show actions menu for active client (status 300) — `3.8s`
   - ✅ Client View & Status Transitions › should show actions menu for closed client (status 600) — `3.2s`
   - ✅ Client View & Status Transitions › should show New Account menu for active client — `3.5s`
   - ✅ Client View & Status Transitions › should navigate from client view to client list via breadcrumb — `3.8s`
   - ✅ Client View & Status Transitions › should navigate back from client view — `3.7s`
   - ✅ Client View Tabs › should display all expected tabs on client view — `3.2s`
   - ✅ Client View Tabs › should switch between client view tabs — `4.1s`
   - ✅ Search & Filter Interactions › should have search input on clients page and accept input — `2.3s`
   - ✅ Search & Filter Interactions › should have office filter on groups page — `2.5s`
   - ✅ Search & Filter Interactions › should have office filter on loans page — `2.2s`
   - ✅ Search & Filter Interactions › should have search input on charges page — `2.2s`
   - ✅ Navigation Flow Verification › should navigate full client lifecycle: list → create → back → list — `3.0s`
   - ✅ Navigation Flow Verification › should navigate from dashboard to all top-level pages via sidebar — `4.9s`
   - ✅ Navigation Flow Verification › should go from loan products → create → back — `3.2s`
   - ✅ Office CRUD › should validate office create form — save disabled when empty — `2.7s`
   - ✅ Office CRUD › should validate office create form — save enabled when filled — `3.8s`
   - ✅ Office CRUD › should cancel office creation — `2.6s`
   - ✅ Organization Create Flows › staff create form loads — `2.6s`
   - ✅ Organization Create Flows › funds create form loads — `2.5s`
   - ✅ Organization Create Flows › payment types create form loads — `2.5s`
   - ✅ Accounting CRUD › accounting closure create form loads — `2.6s`
   - ✅ Accounting CRUD › accounting rule create form loads — `2.9s`
   - ✅ Accounting CRUD › financial activity mapping create form loads — `2.3s`
   - ✅ Accounting CRUD › charge create form loads — `2.6s`
   - ✅ Accounting CRUD › chart of accounts create form loads — `2.3s`
   - ✅ Settings CRUD › global configurations page has editable toggle — `2.3s`
   - ✅ Settings CRUD › holiday create form loads — `2.7s`
   - ✅ Settings CRUD › working days page has save button — `2.4s`
   - ✅ System CRUD › data table create form loads — `2.6s`
   - ✅ System CRUD › delinquency page has create buttons for ranges and buckets — `2.3s`
   - ✅ Security CRUD › role create form loads — `2.4s`
   - ✅ Security CRUD › audit logs search form has date range — `2.7s`
   - ✅ Security CRUD › audit logs list exports the loaded page as CSV — `2.7s`
   - ✅ Reporting — Run Report Flow › should navigate to report and verify report parameters — `3.5s`
   - ✅ Teller CRUD › teller create form loads — `2.7s`
   - ✅ Create Office Dialog from Client Form › should open create office dialog from client create form — `2.8s`
   
   **`global-search-nav-shortcuts.spec.ts`**
   
   - ✅ Global search navigation shortcuts › offers a settings page the entity search cannot return — `2.4s`
   - ✅ Global search navigation shortcuts › navigates to the page behind a shortcut — `2.6s`
   - ✅ Global search navigation shortcuts › keeps the results open across the mousedown that starts a click, so a slow render cannot race the dropdown closed — `2.8s`
   - ✅ Global search navigation shortcuts › withholds a shortcut the user has no permission to reach — `2.9s`
   
   **`global-search-navigation.spec.ts`**
   
   - ✅ Global search navigation › does not query the backend for a single character — `3.0s`
   - ✅ Global search navigation › sends one request for a phrase typed straight through — `3.4s`
   - ✅ Global search navigation › opens the client behind a client result — `2.6s`
   - ✅ Global search navigation › opens the loan behind a loan result — `2.7s`
   - ✅ Global search navigation › opens the savings account behind a savings result — `2.5s`
   - ✅ Global search navigation › clears the query and closes the dropdown after a selection — `2.7s`
   - ✅ Global search navigation › closes the dropdown when focus leaves without a selection — `2.5s`
   - ✅ Global search navigation › shows nothing rather than an empty dropdown when there are no matches — `2.9s`
   
   **`group-detail.spec.ts`**
   
   - ✅ Group detail › custom field tabs expose the app keyboard and panel contract at 1280px — `4.2s`
   - ✅ Group detail › custom field tabs expose the app keyboard and panel contract at 390px — `4.6s`
   - ✅ Group detail › asks for the associations, and shows every member rather than only the active ones — `3.9s`
   - ✅ Group detail › closes a group with the reason id and a Fineract-formatted date — `5.7s`
   - ✅ Group detail › does not offer a client who is already a member, and associates the one it does — `4.3s`
   - ✅ Group detail › unassigns a committee role by the assignment id, not the role id — `4.3s`
   - ✅ Group detail › offers a retry when the group cannot be loaded — `3.7s`
   - ✅ Group detail › says so when no closure reason has been defined — `4.7s`
   
   **`guidance-tour.spec.ts`**
   
   - ✅ the guided tour › highlights the System Status card, not the sidebar, on the dashboard tour — `2.4s`
   - ✅ the guided tour › presents the card as a dialog named and described by its own copy — `2.3s`
   - ✅ the guided tour › announces the step counter as a polite live region — `2.5s`
   - ✅ the guided tour › closes on Escape and hands focus back to the Guide button — `2.0s`
   - ✅ the guided tour › names an unmatched route after itself instead of handing it the dashboard tour — `3.6s`
   - ⏭️ the guided tour at a phone viewport › opens from the overflow menu as a full-width bottom sheet — `2.0s`
   
   **`keyboard-shortcuts.spec.ts`**
   
   - ✅ Alt+C jumps straight to Create Client from anywhere — `2.4s`
   - ✅ Alt+G jumps to Create Group — `2.4s`
   - ✅ Alt+E jumps to Create Center — `2.2s`
   - ✅ Alt+H opens the guidance tour for the current page — `2.1s`
   - ✅ typing in the global search box does not trigger the Create Client shortcut — `2.5s`
   
   **`list-load-failure.spec.ts`**
   
   - ✅ entity-to-entity mapping › renders the rows the endpoint returns, rather than claiming there are none — `3.4s`
   - ✅ entity-to-entity mapping › shows a failure state, not an empty one, when the payload cannot be read — `3.6s`
   - ✅ entity-to-entity mapping › retries and recovers — `4.1s`
   - ✅ report mailing jobs › reads rows out of the paged envelope the endpoint returns — `3.7s`
   - ✅ report mailing jobs › shows a failure state when the request errors — `4.0s`
   
   **`list-pagination.spec.ts`**
   
   - ✅ Server total modes › shows an exact loan count of 1 without opting in — `3.7s`
   - ✅ Server total modes › shows an exact loan count of 11 without opting in — `4.0s`
   - ✅ Server total modes › shows an exact loan count of 21 without opting in — `3.9s`
   - ✅ Server total modes › keeps the unknown total for a full audit page — `3.7s`
   - ✅ List pagination › advances through pages and back again — `4.1s`
   - ✅ List pagination › jumps to the last page — `3.8s`
   - ✅ List pagination › returns to the first page when a filter changes — `4.6s`
   - ✅ List pagination › keeps search text when paging and shows the v2 account number — `4.4s`
   - ✅ List pagination › redirects the old search page and exposes only one client navigation item — `5.4s`
   - ✅ List pagination › keeps an account-number search broad and disables unsupported Office sorting — `4.9s`
   - ✅ List pagination › returns to the first page when searching — `4.8s`
   - ✅ Profile › renders the signed-in user rather than hanging on a spinner — `4.0s`
   - ✅ Profile › changes the signed-in user password from the profile screen — `3.8s`
   - ✅ Profile › shows an error when the profile cannot be loaded — `3.8s`
   - ✅ List load failure › reports the failure and reloads when the user retries — `4.4s`
   - ✅ List load failure › calendars: reports the failure and reloads when the user retries — `4.0s`
   - ✅ List load failure › accounting rules: reports the failure and reloads when the user retries — `4.0s`
   
   **`loan-delinquency-actions.spec.ts`**
   
   - ✅ Delinquency pause and resume on a regular loan › shows the dates as dates, and the pause periods under their real fields — `3.9s`
   - ✅ Delinquency pause and resume on a regular loan › pauses delinquency for a period, from the business date — `4.6s`
   - ✅ Delinquency pause and resume on a regular loan › will not take a pause that ends before, or when, it starts — `4.0s`
   - ✅ Delinquency pause and resume on a regular loan › sends nothing when the pause dialog is cancelled — `5.1s`
   - ✅ Delinquency pause and resume on a regular loan › shows the platform’s own reason when it refuses a pause, and stays usable — `4.4s`
   - ✅ Delinquency pause and resume on a regular loan › resumes a pause that is in effect, dated the business date and with no end date — `4.6s`
   - ✅ Delinquency pause and resume on a regular loan › stops offering resume once the pause has been ended — `4.2s`
   - ✅ Delinquency pause and resume on a regular loan › does not offer resume when no pause is in effect — `3.8s`
   - ✅ Delinquency pause and resume on a regular loan › offers neither action without the permission to create a delinquency action — `3.8s`
   - ✅ Delinquency pause and resume on a regular loan › offers the permitted user the actions that permission opens, and no others — `3.6s`
   - ✅ Delinquency pause and resume on a regular loan › offers neither action on a loan that is not active — `3.8s`
   
   **`loan-portfolio-summary.spec.ts`**
   
   - ✅ Loan Portfolio Summary › searching sends entities: loans and shows the grouped results — `3.7s`
   - ✅ Loan Portfolio Summary › Edit Parameters returns from the results view to the filter form — `3.7s`
   - ✅ Loan Portfolio Summary › checking the outstanding-amount filter sends the between min/max values — `3.9s`
   - ✅ Loan Portfolio Summary › switching to a single-value comparison condition sends one value — `4.5s`
   
   **`loan-product-down-payment.spec.ts`**
   
   - ✅ Loan product down payment and tranches › down payment is offered only for a progressive product — `4.6s`
   - ✅ Loan product down payment and tranches › the percentage and auto-repayment appear only once down payment is on — `4.7s`
   - ✅ Loan product down payment and tranches › multi-tranche disbursement reveals its tranche count, on either engine — `4.2s`
   - ✅ Loan product down payment and tranches › submits the down payment and tranche settings it was given — `5.1s`
   - ✅ Loan product down payment and tranches › does not send a down payment on a cumulative product — `5.7s`
   - ✅ Loan product down payment and tranches › income recognition is offered only for a progressive product — `4.9s`
   - ✅ Loan product down payment and tranches › the capitalisation details appear only once it is on — `4.4s`
   - ✅ Loan product down payment and tranches › submits the income recognition settings it was given — `5.0s`
   - ✅ Loan product down payment and tranches › does not send income recognition on a cumulative product — `5.8s`
   - ✅ Loan product down payment and tranches › interest recalculation reveals its mandatory settings only once it is on — `3.9s`
   - ✅ Loan product down payment and tranches › the rest interval appears only when the frequency is not the repayment period — `4.6s`
   - ✅ Loan product down payment and tranches › submits the interest recalculation settings it was given — `4.2s`
   - ✅ Loan product down payment and tranches › does not send recalculation settings once it is switched back off — `4.0s`
   
   **`loan-schedule-type-gating.spec.ts`**
   
   - ✅ Loan schedule type gating › a cumulative loan offers neither progressive-only tab, and fetches neither — `3.8s`
   - ✅ Loan schedule type gating › a progressive loan shows only the capabilities it actually has — `4.1s`
   - ✅ Loan schedule type gating › fetches buy-down fees for a progressive loan that has no external id — `3.3s`
   - ✅ Loan schedule type gating › a progressive loan with both capabilities shows both — `3.7s`
   - ✅ Loan schedule type gating › a charged-off loan says so and offers the reversal instead — `4.0s`
   - ✅ Loan schedule type gating › a healthy loan offers charge-off and no marker — `3.6s`
   
   **`charge-refund.spec.ts`**
   
   - ✅ refunds the remaining balance of a collected loan charge — `6.2s`
   
   **`client-accounts.spec.ts`**
   
   - ✅ loan account rows show the principal returned by the accounts endpoint — `3.8s`
   - ✅ empty account tabs offer the matching creation action — `6.1s`
   
   **`client-load-error.spec.ts`**
   
   - ✅ shows a not-found state and returns to the list, without an error toast — `3.8s`
   - ✅ offers a retry for a transient failure, and recovers on success — `3.6s`
   
   **`contract-termination.spec.ts`**
   
   - ✅ terminates and undoes a progressive loan contract — `8.2s`
   
   **`loan-servicing-gaps.spec.ts`**
   
   - ✅ Loan servicing gaps › edits an interest pause through PUT while preserving its existing dates — `3.7s`
   - ✅ Loan servicing gaps › undo approval sends an empty body, without the locale the platform refuses — `4.4s`
   - ✅ Loan servicing gaps › undo approval carries the reason when one was given — `4.3s`
   - ✅ Loan servicing gaps › undo approval is offered only while the loan is approved — `3.5s`
   - ✅ Loan servicing gaps › the delinquency tab shows the summary the loan carries and the tags it fetches — `3.6s`
   - ✅ Loan servicing gaps › the data-only tabs stay hidden when the loan carries nothing for them — `3.5s`
   - ✅ Loan servicing gaps › each data-only tab appears and renders once the loan carries its data — `3.4s`
   - ✅ Loan servicing gaps › disburse to savings sends the date and amount, with the platform date format — `4.1s`
   - ✅ Loan servicing gaps › disburse to savings is offered only on an approved loan — `3.5s`
   - ✅ Loan servicing gaps › unassign loan officer sends the date, and appears only when one is assigned — `4.0s`
   - ✅ Loan servicing gaps › unassign loan officer is hidden on a loan with no officer — `3.5s`
   - ✅ Loan servicing gaps › undo last disbursal appears only on a multi-disbursal loan, and sends an empty body — `3.9s`
   - ✅ Loan servicing gaps › undo last disbursal is hidden on a single-disbursal loan — `3.6s`
   - ✅ Loan servicing gaps › close as rescheduled is offered on an active loan — `4.0s`
   - ✅ Loan servicing gaps › revising the amounts is offered on an approved loan — `3.4s`
   - ✅ Loan servicing gaps › revising the amounts is hidden before approval — `3.2s`
   - ✅ Loan servicing gaps › revising the approved amount sends the new amount and locale — `4.3s`
   - ✅ Loan servicing gaps › revising the available disbursement amount sends the new amount, including zero — `4.4s`
   
   **`logout-reason-notice.spec.ts`**
   
   - ✅ explains an inactivity sign-out — `1.4s`
   - ✅ explains an expired session, with different wording — `1.2s`
   - ✅ stays silent when the user came to sign in of their own accord — `160ms`
   - ✅ stays silent for a reason it does not recognise, rather than showing a blank notice — `238ms`
   
   **`oidc-login.spec.ts`**
   
   - ✅ identity-provider route on the login page › a deployment that never set the flag sees the screen it always saw — `1.3s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is false — `1.7s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is "true" — `1.2s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is 1 — `1.2s`
   - ✅ identity-provider route on the login page › does not offer the route when the oidc block is missing, and keeps the form — `1.2s`
   - ✅ identity-provider route on the login page › offers the route above the password form, which stays in place — `1.8s`
   - ✅ identity-provider route on the login page › removes the password form only when the deployment asks and OIDC is configured — `2.0s`
   - ✅ identity-provider route on the login page › username and password still sign in when the route is offered — `1.9s`
   - ✅ identity-provider route on the login page › is not offered while a second factor is being asked for — `1.4s`
   - ✅ signing in through the identity provider › sends the browser to the provider with PKCE S256, then opens a session from userdetails — `3.2s`
   - ✅ signing in through the identity provider › does not open a session when the server does not serve userdetails (404) — `3.3s`
   - ✅ signing in through the identity provider › does not open a session when the callback state does not match — `1.2s`
   
   **`rbac-feature-flag.spec.ts`**
   
   - ✅ RBAC permission gating (rbacEnabled = true) › a limited user does not see permission-gated nav groups — `1.8s`
   - ✅ RBAC permission gating (rbacEnabled = true) › a user with READ_USER sees only the Security entries that permission covers — `1.5s`
   - ✅ RBAC permission gating (rbacEnabled = true) › the Security group fills in as the user is granted each of its permissions — `1.7s`
   - ✅ RBAC permission gating (rbacEnabled = true) › a superuser (ALL_FUNCTIONS) sees all permission-gated groups — `1.9s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › universal institution shows Groups, Centers and Collection Sheet — `2.1s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › commercial bank (cb) hides all group-lending features — `1.9s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › credit union (cu) shows Groups but hides Centers and Collection Sheet — `1.9s`
   - ✅ rbacEnabled = false › restores the pre-RBAC behaviour of showing everything — `2.0s`
   - ✅ deployment navigation overrides › removes the entries the deployment names by id, leaving the rest alone — `2.0s`
   - ✅ deployment navigation overrides › ignores a labelKey where an id is required — `2.1s`
   - ✅ deployment navigation overrides › removes them even where RBAC is off — `1.9s`
   
   **`rbac-route-protection.spec.ts`**
   
   - ✅ route authorization › a superuser reaches every sampled route and sees the full navigation — `13.8s`
   - ✅ route authorization › a single-module user is confined to that module — `9.4s`
   - ✅ route authorization › a read-only user gets the lists and not the forms — `12.0s`
   - ✅ route authorization › a user with an empty permission list is refused everywhere and the app still works — `9.8s`
   - ✅ route authorization › a session carrying no permissions field is treated as carrying none — `6.0s`
   - ✅ route authorization › an unrecognised permission code grants nothing — `6.0s`
   - ✅ route authorization › an unauthenticated visitor is asked to sign in, not told they are forbidden — `6.0s`
   - ✅ route authorization › a deployment with RBAC turned off behaves as it did before the guard — `8.3s`
   - ✅ the Access Denied page › says what happened, under a single heading — `4.1s`
   - ✅ the Access Denied page › moves focus to the heading, since the user did not ask to come here — `3.8s`
   - ✅ the Access Denied page › announces itself politely — `3.6s`
   - ✅ the Access Denied page › names the permissions the screen wanted, so the user can ask for them — `3.8s`
   - ✅ the Access Denied page › offers a way back that the user is allowed to take — `3.7s`
   - ✅ the Access Denied page › is reachable by keyboard alone — `3.6s`
   - ✅ permission feedback › a visible nav entry says what the user can do in that module — `1.8s`
   - ✅ permission feedback › a nav entry carries no hint when there is nothing specific to say — `2.0s`
   - ✅ navigation and routes agree › a hidden menu entry is also refused by URL, and a shown one is not — `5.7s`
   - ✅ navigation and routes agree › the create button is withheld from a user whose create route would refuse them — `4.1s`
   
   **`report-enhancements.spec.ts`**
   
   - ✅ Report Enhancements, Pagination, and Help Tour › should run report, show paginated data, and download CSV — `4.3s`
   - ✅ Report Enhancements, Pagination, and Help Tour › should trigger guidance help tour and navigate steps — `3.5s`
   
   **`reporting.spec.ts`**
   
   - ✅ Reporting › should display list of reports — `2.3s`
   - ✅ Reporting › should navigate to run report page — `2.1s`
   
   **`scheduler-jobs.spec.ts`**
   
   - ✅ Scheduler Jobs bulk run › Run Selected is disabled until a job is checked — `3.8s`
   - ✅ Scheduler Jobs bulk run › Select All checks every job, and running confirms then triggers each one — `4.2s`
   - ✅ Scheduler Jobs bulk run › declining the confirmation runs nothing — `4.2s`
   
   **`sidebar-active-state.spec.ts`**
   
   - ✅ Sidebar active route matching › does not mark a parent sidebar link active on nested routes — `1m 27s`
   
   **`two-factor-authentication.spec.ts`**
   
   - ✅ two-step verification › asks for a code and lets the user in once it is accepted — `1.9s`
   - ✅ two-step verification › sends the token on every later request — `1.8s`
   - ✅ two-step verification › keeps the user on the step when the code is wrong, and says why — `1.9s`
   - ✅ two-step verification › accepts a correct code after a wrong one — `2.1s`
   - ✅ two-step verification › offers the choice when there is more than one channel — `1.8s`
   - ✅ two-step verification › says so when the account has no channel configured — `1.7s`
   - ✅ two-step verification › returns to the choice when the code could not be sent — `1.7s`
   - ✅ two-step verification › does not let a half-finished session reach the application — `3.6s`
   - ✅ two-step verification › backing out returns to the password form — `1.7s`
   - ✅ two-step verification › a deployment without a second factor signs in exactly as before — `2.0s`
   
   **`working-capital-loan-actions.spec.ts`**
   
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows delinquency action history and submits a new one — `4.7s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows breach action history and submits a new one — `5.6s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows near-breach action history and submits a new one — `4.4s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › attaches and detaches a loan originator — `4.8s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › adds a new charge and waives an existing one — `4.8s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows rate-change history, amortization schedule, and delinquency range tags — `4.0s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › marks the loan as fraud, applies a discount, and changes the payment rate — `5.8s`
   - ✅ Working Capital loan transactions, loss actions and modification › credits the borrower through a goodwill credit — `4.3s`
   - ✅ Working Capital loan transactions, loss actions and modification › refunds a merchant payout — `4.2s`
   - ✅ Working Capital loan transactions, loss actions and modification › refunds a credit balance only on an overpaid loan — `4.4s`
   - ✅ Working Capital loan transactions, loss actions and modification › charges off an active loan — `4.4s`
   - ✅ Working Capital loan transactions, loss actions and modification › swaps charge-off for its undo once the loan is charged off — `3.7s`
   - ✅ Working Capital loan transactions, loss actions and modification › writes off an active loan — `4.4s`
   - ✅ Working Capital loan transactions, loss actions and modification › offers recovery and undo on a written-off loan, but not a second write-off — `3.8s`
   - ✅ Working Capital loan transactions, loss actions and modification › withholds undo write-off once a recovery has been collected — `3.9s`
   - ✅ Working Capital loan transactions, loss actions and modification › modifies a submitted application through the edit route — `5.3s`
   - ✅ Working Capital loan transactions, loss actions and modification › disables the actions a read-only role may not perform — `3.5s`
   
   </details>
   
   <details>
   <summary><b>Slowest 10</b> — what the shard counts should be tuned against</summary>
   
   | Test | Spec | Time |
   | --- | --- | ---: |
   | Sidebar active route matching › does not mark a parent sidebar link active on nested routes | `sidebar-active-state.spec.ts` | 1m 27s |
   | route authorization › a superuser reaches every sampled route and sees the full navigation | `rbac-route-protection.spec.ts` | 13.8s |
   | route authorization › a read-only user gets the lists and not the forms | `rbac-route-protection.spec.ts` | 12.0s |
   | route authorization › a user with an empty permission list is refused everywhere and the app still works | `rbac-route-protection.spec.ts` | 9.8s |
   | route authorization › a single-module user is confined to that module | `rbac-route-protection.spec.ts` | 9.4s |
   | route authorization › a deployment with RBAC turned off behaves as it did before the guard | `rbac-route-protection.spec.ts` | 8.3s |
   | terminates and undoes a progressive loan contract | `contract-termination.spec.ts` | 8.2s |
   | refunds the remaining balance of a collected loan charge | `charge-refund.spec.ts` | 6.2s |
   | Client form date pickers › stay usable on a second visit to the create form | `client-date-picker-revisit.spec.ts` | 6.2s |
   | empty account tabs offer the matching creation action | `client-accounts.spec.ts` | 6.1s |
   
   </details>
   
   
   📼 [Download the HTML report, videos and traces](https://github.com/apache/fineract-backoffice-ui/actions/runs/39254700392) — see the `playwright-report-mocked` artifact.
   
   <sub>Generated by [run 39254700392](https://github.com/apache/fineract-backoffice-ui/actions/runs/39254700392) from `71fd35a`. The run executed a fork branch, so treat its contents as unverified.</sub>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(auth): sign in through an OpenID Connect identity provider [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal commented on code in PR #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818#discussion_r4385337669


##########
src/app/core/services/oidc.service.ts:
##########
@@ -0,0 +1,460 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Injectable, inject } from '@angular/core';
+import { Subject } from 'rxjs';
+import { STORAGE } from '../adapters';
+import { ConfigService, OidcConfig } from './config.service';
+
+/** The endpoints of the provider that this application uses, read from its discovery document. */
+interface DiscoveryDocument {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  end_session_endpoint?: string;
+}
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  id_token?: string;
+  expires_in?: number;
+  refresh_expires_in?: number;
+}
+
+/** The tokens of the signed-in user, kept for the life of the tab. */
+export interface OidcTokens {
+  accessToken: string;
+  refreshToken?: string;
+  idToken?: string;
+  /** Epoch milliseconds at which the access token stops being valid. */
+  expiresAt: number;
+  /** Epoch milliseconds at which the refresh token stops being valid, when the provider says. */
+  refreshExpiresAt?: number;
+}
+
+/** A sign-in in progress: what must be remembered across the redirect to the provider. */
+interface OidcFlow {
+  state: string;
+  nonce: string;
+  verifier: string;
+}
+
+/** Refresh this long before the access token expires. */
+export const REFRESH_SKEW_MS = 60_000;
+
+/** Tolerated difference between the provider's clock and this browser's, for `exp` and `iat`, in seconds. */
+const CLOCK_SKEW_S = 60;
+
+const DEFAULT_SCOPES = 'openid profile';
+const DEFAULT_REDIRECT_PATH = '/auth/callback';
+const DEFAULT_POST_LOGOUT_PATH = '/login';
+
+/** Why a sign-in could not be completed. The message is for the log, never for the user. */
+export class OidcError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'OidcError';
+  }
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = '';
+  for (const b of bytes) binary += String.fromCodePoint(b);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+
+function randomString(byteLength = 32): string {
+  return base64Url(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+
+/** The S256 code challenge for a verifier (RFC 7636 section 4.2). */
+export async function pkceChallenge(verifier: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+  return base64Url(new Uint8Array(digest));
+}
+
+/** The claims of a JWT. Not verified: only ever applied to an ID token the token endpoint returned. */
+function jwtClaims(jwt: string): Record<string, unknown> {
+  try {
+    const payload = jwt.split('.', 2)[1].replaceAll('-', '+').replaceAll('_', '/');
+    const bytes = Uint8Array.from(
+      atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, '=')),
+      (c) => c.codePointAt(0) ?? 0,
+    );
+    return JSON.parse(new TextDecoder().decode(bytes)) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * OpenID Connect sign-in for a public client: authorization-code flow with PKCE (S256), token
+ * refresh, and RP-initiated logout.
+ *
+ * Written in-house rather than taken from a library, and kept small (see `DOCS/OIDC.md`): it
+ * needs no dependency and no iframe or session-check timers, and it talks to the provider with
+ * `fetch` so that none of this application's HTTP interceptors (which add tenant headers that a
+ * provider's CORS policy refuses) sees the traffic. It does not verify an ID token's signature:
+ * the token is received straight from the token endpoint named by the provider's discovery
+ * document, which OpenID Connect Core section 3.1.3.7 accepts. Fineract validates the access
+ * token on every call.
+ *
+ * Tokens live in tab-scoped storage and are cleared by `clearScope('session')` on sign-out.
+ */
+@Injectable({ providedIn: 'root' })
+export class OidcService {
+  private readonly configService = inject(ConfigService);
+  private readonly storage = inject(STORAGE);
+
+  /** Emits when the provider refused a refresh: the session is over and the user must sign in again. */
+  readonly sessionEnded = new Subject<void>();
+
+  private discovery: Promise<DiscoveryDocument> | null = null;
+  private discoveryFor: string | null = null;
+  private refreshing: Promise<void> | null = null;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  /** Bumped by every {@link clear}; a request that started in an earlier generation is dropped. */
+  private generation = 0;
+
+  constructor() {
+    if (this.hasSession()) this.scheduleRefresh();
+  }
+
+  /** The configured provider, or `null` when OIDC sign-in is not configured. */
+  get config(): OidcConfig | null {
+    return this.configService.oidcConfig();
+  }
+
+  /** Whether this tab holds OIDC tokens. */
+  hasSession(): boolean {
+    return !!this.tokens()?.accessToken;
+  }
+
+  /** The current access token, or `null`. Use {@link ensureFresh} first when it must not be about to expire. */
+  getAccessToken(): string | null {
+    return this.tokens()?.accessToken ?? null;
+  }
+
+  /** Redirects the browser to the provider's sign-in page. */
+  async startLogin(): Promise<void> {
+    const cfg = this.requireConfig();
+    const doc = await this.discover();
+    const flow: OidcFlow = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(48),
+    };
+    this.storage.write('oidcFlow', flow);
+    const query = new URLSearchParams({
+      client_id: cfg.clientId,
+      redirect_uri: this.redirectUri(),
+      response_type: 'code',
+      scope: this.scopes(),
+      state: flow.state,
+      nonce: flow.nonce,
+      code_challenge: await pkceChallenge(flow.verifier),
+      code_challenge_method: 'S256',
+    });
+    this.navigate(`${doc.authorization_endpoint}?${query.toString()}`);
+  }
+
+  /**
+   * Finishes a sign-in: checks `state`, exchanges the code (with the PKCE verifier) for tokens,
+   * checks the ID token's `nonce`, issuer and audience, and stores the tokens.
+   *
+   * @param params - the query parameters of the redirect back to this application
+   */
+  async completeLogin(params: URLSearchParams): Promise<void> {
+    const cfg = this.requireConfig();
+    const flow = this.storage.read<OidcFlow | null>('oidcFlow', null);
+    // One attempt per flow: a replayed redirect finds nothing to check against.
+    this.storage.remove('oidcFlow');
+    const providerError = params.get('error');
+    if (providerError) throw new OidcError(`provider returned ${providerError}`, providerError);
+    const code = params.get('code');
+    if (!flow || !code || params.get('state') !== flow.state) {
+      throw new OidcError('missing or mismatched state', 'invalid_state');
+    }
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const doc = await this.discover();
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    const body = await this.tokenRequest(doc, {
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: this.redirectUri(),
+      client_id: cfg.clientId,
+      code_verifier: flow.verifier,
+    });
+    this.validateIdToken(body.id_token, flow.nonce, doc.issuer, cfg.clientId);
+    // A sign-out while the code was being exchanged wins: do not open a session after it.
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    this.store(body, undefined);
+  }
+
+  /**
+   * Checks the ID token of a code exchange (OpenID Connect Core 3.1.3.7). It is required: it is what
+   * `endSession` later sends as `id_token_hint`, without which the provider asks for confirmation
+   * instead of ending the session.
+   *
+   * The signature is deliberately not verified: the token arrives in the back-channel response of
+   * the token endpoint named by the provider's discovery document, over TLS (rule 6 of 3.1.3.7),
+   * and this application takes nothing from it but these claims. Fineract validates the access
+   * token, signature included, on every call.
+   */
+  private validateIdToken(
+    idToken: string | undefined,
+    nonce: string,
+    issuer: string,
+    clientId: string,
+  ): void {
+    if (!idToken) throw new OidcError('the token response has no ID token', 'invalid_id_token');
+    const claims = jwtClaims(idToken);
+    const aud = ([] as unknown[]).concat(claims['aud']);
+    const now = Date.now() / 1000;
+    const exp = Number(claims['exp']);
+    const iat = Number(claims['iat']);
+    const failed = (
+      [
+        ['nonce', claims['nonce'] === nonce],
+        ['issuer', claims['iss'] === issuer],
+        ['audience', aud.includes(clientId)],
+        ['authorized party', claims['azp'] === undefined || claims['azp'] === clientId],
+        ['expiry', Number.isFinite(exp) && exp + CLOCK_SKEW_S >= now],
+        ['issue time', !Number.isFinite(iat) || iat - CLOCK_SKEW_S <= now],
+      ] as const
+    ).find(([, ok]) => !ok);
+    const problem = failed?.[0];
+    if (problem) throw new OidcError(`ID token ${problem} check failed`, 'invalid_id_token');
+  }
+
+  /** The ID token of the signed-in user, or `null`. Read it before clearing the session: sign-out needs it. */
+  getIdToken(): string | null {
+    return this.tokens()?.idToken ?? null;
+  }
+
+  /**
+   * Makes sure the access token is valid for at least {@link REFRESH_SKEW_MS}, refreshing it if
+   * not. Concurrent callers share one refresh. A refusal by the provider ends the session; a
+   * network failure leaves it as it is and rejects, so the request still goes out and Fineract
+   * decides.
+   */
+  ensureFresh(): Promise<void> {
+    const t = this.tokens();
+    if (!t || t.expiresAt - Date.now() > REFRESH_SKEW_MS) return Promise.resolve();
+    this.refreshing ??= this.refresh().finally(() => (this.refreshing = null));
+    return this.refreshing;
+  }
+
+  /**
+   * Signs out at the provider (OpenID Connect RP-Initiated Logout 1.0) and comes back to the
+   * login page. The local tokens are dropped first, so the application is signed out even if the
+   * provider cannot be reached.
+   *
+   * @param idTokenHint - the user's ID token, read by the caller before the session was cleared.
+   *   Always sent as `id_token_hint` together with `post_logout_redirect_uri`: without the hint
+   *   Keycloak shows a confirmation page, and a user who closes it leaves the SSO session alive.
+   *   Defaults to the stored token, for a caller that has not cleared anything yet.
+   */
+  async endSession(idTokenHint?: string | null): Promise<void> {
+    const cfg = this.config;
+    const idToken = idTokenHint ?? this.getIdToken();
+    this.clear();
+    if (!cfg) return;
+    try {
+      const doc = await this.discover();
+      if (!doc.end_session_endpoint) return;
+      const query = new URLSearchParams({
+        client_id: cfg.clientId,
+        post_logout_redirect_uri: this.origin() + (cfg.postLogoutPath ?? DEFAULT_POST_LOGOUT_PATH),
+      });
+      if (idToken) query.set('id_token_hint', idToken);
+      this.navigate(`${doc.end_session_endpoint}?${query.toString()}`);
+    } catch {
+      // The provider is unreachable: the local sign-out above already happened.
+    }
+  }
+
+  /** Drops the tokens and any pending timer, without telling the provider. */
+  clear(): void {
+    // Anything in flight (a refresh, a code exchange) started before this and must not store its result.
+    this.generation++;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    this.storage.remove('oidcTokens');
+    this.storage.remove('oidcFlow');
+  }
+
+  /** Seam for tests: the only place that leaves the application. */
+  protected navigate(url: string): void {
+    window.location.assign(url);
+  }
+
+  protected origin(): string {
+    return window.location.origin;
+  }
+
+  private redirectUri(): string {
+    return this.origin() + (this.requireConfig().redirectPath ?? DEFAULT_REDIRECT_PATH);
+  }
+
+  /** The requested scopes. `offline_access` is dropped: it would make the refresh token outlive sign-out. */
+  private scopes(): string {
+    const asked = (this.requireConfig().scopes ?? DEFAULT_SCOPES).split(/\s+/).filter(Boolean);
+    return asked.filter((s) => s !== 'offline_access').join(' ');
+  }
+
+  private requireConfig(): OidcConfig {
+    const cfg = this.config;
+    if (!cfg) throw new OidcError('OIDC sign-in is not configured', 'not_configured');
+    return cfg;
+  }
+
+  private tokens(): OidcTokens | null {
+    return this.storage.read<OidcTokens | null>('oidcTokens', null);
+  }
+
+  private async refresh(): Promise<void> {
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const t = this.tokens();
+    const cfg = this.config;
+    if (!t || !cfg) return;
+    if (!t.refreshToken || (t.refreshExpiresAt && t.refreshExpiresAt <= Date.now())) {
+      this.endLocally();
+      return;
+    }
+    const doc = await this.discover();
+    if (generation !== this.generation) return;
+    try {
+      const body = await this.tokenRequest(doc, {
+        grant_type: 'refresh_token',
+        refresh_token: t.refreshToken,
+        client_id: cfg.clientId,
+      });
+      // Signed out while the refresh was in flight: drop the answer, or it would restore the session.
+      if (generation !== this.generation) return;
+      this.store(body, t);
+    } catch (e) {
+      if (generation !== this.generation) return;
+      // invalid_grant and friends: the provider session is gone. A network error is not.
+      if (e instanceof OidcError) this.endLocally();
+      throw e;
+    }
+  }
+
+  private endLocally(): void {
+    this.clear();
+    this.sessionEnded.next();
+  }
+
+  private store(body: TokenResponse, previous: OidcTokens | undefined): void {
+    const now = Date.now();
+    const tokens: OidcTokens = {
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token ?? previous?.refreshToken,
+      idToken: body.id_token ?? previous?.idToken,
+      expiresAt: now + (body.expires_in ?? 60) * 1000,

Review Comment:
   **Refresh loop.** The fallback lifetime (`expires_in ?? 60`) equals `REFRESH_SKEW_MS` (60 000), so:
   - `ensureFresh`'s `expiresAt - now > REFRESH_SKEW_MS` is never true, and every API call waits on a refresh;
   - `scheduleRefresh` computes `Math.max(0, 1000)` and re-fires every **1 s**.
   
   The same happens for any provider configured with an access-token lifetime of 60 s or less (`expires_in` is only RECOMMENDED in RFC 6749). The result is an endless `refresh_token` grant loop against the IdP.
   
   Suggested:
   - fall back to the JWT `exp`, or something like 300 s;
   - use `skew = min(60 s, lifetime / 2)`;
   - floor the timer delay (e.g. 15 s);
   - add unit tests for `expires_in` missing and set to 30.



##########
DOCS/OIDC.md:
##########
@@ -125,3 +125,101 @@ Using Keycloak, which is the dialect upstream documents most fully:
 Permissions are unaffected: they continue to come from Fineract's own role model, whichever way the
 user authenticated, and are evaluated by `AuthService.hasPermission()` as described in
 [DOCS/RBAC.md](RBAC.md).
+
+## Signing in through the identity provider
+
+The login page can offer **Sign in with your identity provider**, which signs a user in with the
+authorization-code flow and PKCE (S256) as a **public client**. No client secret exists or is
+needed. Fineract still only validates the Bearer token, as described above; this is the client half.
+
+The feature is **opt-in**. Without the keys below the login page is unchanged: a username and
+password, and nothing else.
+
+### Configuration
+
+Turn it on in `config.json` (or the deployment's `branding/config.json`):
+
+```json
+{
+  "oidcLoginEnabled": true,
+  "oidc": {
+    "issuer": "https://keycloak.example/realms/fineract",
+    "clientId": "fineract-backoffice-ui",
+    "scopes": "openid profile"
+  },
+  "passwordLoginEnabled": false
+}
+```
+
+| Key                    | Default          | Meaning                                                                         |
+| ---------------------- | ---------------- | ------------------------------------------------------------------------------- |
+| `oidcLoginEnabled`     | `false`          | Offers the identity-provider button. Must be exactly `true`.                    |
+| `oidc.issuer`          | _(required)_     | Issuer URL; discovery is read from `<issuer>/.well-known/openid-configuration`. |
+| `oidc.clientId`        | _(required)_     | The public client registered with the provider.                                 |
+| `oidc.scopes`          | `openid profile` | Space-separated. `offline_access` is dropped even if listed.                    |
+| `oidc.redirectPath`    | `/auth/callback` | Path on this application's origin that receives the authorization code.         |
+| `oidc.postLogoutPath`  | `/login`         | Path on this application's origin to return to after sign-out.                  |
+| `passwordLoginEnabled` | `true`           | `false` removes the username and password form (see below).                     |
+
+- `oidcLoginEnabled` is ignored unless `oidc.issuer` and `oidc.clientId` are both set.
+- `passwordLoginEnabled: false` is ignored unless OIDC sign-in is enabled and complete, so a mistaken
+  config cannot lock everyone out. It hides the form only; it does not stop Fineract from accepting
+  Basic credentials, which is a server setting.
+- The Content-Security-Policy must allow the provider: add its origin to `connect-src`. The

Review Comment:
   **The shipped container can't do this.** `deploy/nginx.conf.template:50` hard-codes `connect-src 'self'`, and `deploy/entrypoint.sh` only substitutes `FINERACT_UPSTREAM`, `FINERACT_PROXY_SSL_VERIFY` and `FINERACT_FORWARDED_PROTO`. With the official image, the discovery `fetch` and the token `fetch` to the IdP are blocked, so users always see "The identity provider could not be reached". The authorize redirect still works because it's a navigation.
   
   Please add an entrypoint setting (e.g. `OIDC_ISSUER_ORIGIN`) that's appended to `connect-src`, or support proxying the IdP's `.well-known` and token endpoints through the same origin. Either way, document it here instead of asking operators to hand-edit the CSP.



##########
src/app/core/services/auth.service.ts:
##########
@@ -153,10 +212,59 @@ export class AuthService {
       );
   }
 
+  constructor() {
+    // The provider refused a token refresh: the session is over. Local sign-out only, the
+    // provider has already ended its side.
+    this.oidc.sessionEnded.subscribe(() => {
+      if (!this.isAuthenticated()) return;
+      this.clearSession();
+      void this.injector
+        .get(Router)
+        .navigate(['/login'], { queryParams: { reason: SESSION_EXPIRED_REASON } });
+    });
+  }
+
   /**
-   * Logs out the current user and clears the session state.
+   * Completes an identity-provider sign-in: asks Fineract who the Bearer token belongs to
+   * (`GET /v1/userdetails`) and opens the session from the answer. The tokens must already be
+   * stored (`OidcService.completeLogin`).
+   *
+   * @returns the resulting session. On failure the tokens are dropped, so nobody is left half signed in.
+   */
+  completeOidcLogin(): Observable<UserSession> {
+    const tenantId = this.currentTenantId();
+    return this.http
+      .get<UserDetailsResponse>(`${this.configService.apiUrl}/userdetails`, {
+        headers: new HttpHeaders({
+          Authorization: `Bearer ${this.oidc.getAccessToken() ?? ''}`,
+          'Fineract-Platform-TenantId': tenantId,
+          'X-Mifos-Platform-TenantId': tenantId,
+        }),
+        context: skipErrorToast(),
+      })
+      .pipe(
+        map((details) => sessionFromUserDetails(details)),
+        tap({
+          next: (session) => this.setSession(session),
+          error: () => this.oidc.clear(),
+        }),
+      );
+  }
+
+  /**
+   * Logs out the current user and clears the session state. An identity-provider session is
+   * also ended at the provider (the browser is redirected there and back to the login page).
    */
   logout(): void {
+    const viaProvider = this.isOidcSession() || this.oidc.hasSession();
+    // Read before clearing: clearSession() wipes the tokens, and the provider needs the ID token
+    // as id_token_hint to end its session without asking the user to confirm.
+    const idToken = this.oidc.getIdToken();
+    this.clearSession();
+    if (viaProvider) void this.oidc.endSession(idToken);

Review Comment:
   **OIDC users lose the sign-out reason.** `idle.service.ts` and `error.interceptor.ts` call `logout()` and then navigate to `/login?reason=…`. For OIDC sessions, `endSession` does a `window.location.assign(end_session_endpoint…)` that returns to the fixed `postLogoutPath`, without the reason. So someone timed out for inactivity, or whose token Fineract rejected, sees a plain login page with no explanation; basic-auth users still get the message.
   
   Please carry the reason through, e.g. stash it in session storage before redirecting and read it on `/login`, or append it to `post_logout_redirect_uri` if the IdP allows that.



##########
src/app/core/adapters/storage/storage-keys.ts:
##########
@@ -51,6 +51,10 @@ export type StorageScope = 'session' | 'device';
 export const STORAGE_KEYS = {
   /** The authenticated session, including the Basic auth key. Tab-scoped, never persisted. */
   session: { key: 'fineract_session', scope: 'session' },
+  /** The OIDC tokens of the signed-in user. Tab-scoped, never persisted. */
+  oidcTokens: { key: 'fineract_oidc_tokens', scope: 'session' },

Review Comment:
   Security hardening, non-blocking. This matches how the Basic key is stored, and the strict CSP limits XSS. But a refresh token taken from the session-scoped store is worse than a stolen Basic key: the client is public and nothing ties the token to this browser, so whoever holds it can mint new access tokens from anywhere until it expires.
   
   At minimum, `DOCS/security.md` should require refresh-token rotation at the IdP (Keycloak "Revoke Refresh Token", reuse 0). Better options are keeping the refresh token in memory only (accepting a re-login on reload) or DPoP.
   
   Also, when the IdP has no `end_session_endpoint`, logout returns early (`oidc.service.ts:288`) without calling the revocation endpoint, so the refresh token stays valid at the IdP.



##########
src/app/core/services/auth.service.ts:
##########
@@ -153,10 +212,59 @@ export class AuthService {
       );
   }
 
+  constructor() {
+    // The provider refused a token refresh: the session is over. Local sign-out only, the
+    // provider has already ended its side.
+    this.oidc.sessionEnded.subscribe(() => {
+      if (!this.isAuthenticated()) return;
+      this.clearSession();
+      void this.injector
+        .get(Router)
+        .navigate(['/login'], { queryParams: { reason: SESSION_EXPIRED_REASON } });
+    });
+  }
+
   /**
-   * Logs out the current user and clears the session state.
+   * Completes an identity-provider sign-in: asks Fineract who the Bearer token belongs to
+   * (`GET /v1/userdetails`) and opens the session from the answer. The tokens must already be
+   * stored (`OidcService.completeLogin`).
+   *
+   * @returns the resulting session. On failure the tokens are dropped, so nobody is left half signed in.
+   */
+  completeOidcLogin(): Observable<UserSession> {
+    const tenantId = this.currentTenantId();
+    return this.http
+      .get<UserDetailsResponse>(`${this.configService.apiUrl}/userdetails`, {

Review Comment:
   **Blocking (platform dependency).** On current Fineract this call 404s in the mode an external IdP uses. `UserDetailsApiResource` is `@ConditionalOnProperty("fineract.security.oauth2.enabled")` (Fineract as its own authorization server), and federation (`fineract.security.oidc-federation.enabled`) doesn't load it. So every sign-in ends on "server cannot identify users".
   
   Please link the Fineract change (Jira plus PR) this depends on, and gate or document the feature by minimum Fineract version until it's released.



##########
src/app/core/services/oidc.service.ts:
##########
@@ -0,0 +1,460 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Injectable, inject } from '@angular/core';
+import { Subject } from 'rxjs';
+import { STORAGE } from '../adapters';
+import { ConfigService, OidcConfig } from './config.service';
+
+/** The endpoints of the provider that this application uses, read from its discovery document. */
+interface DiscoveryDocument {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  end_session_endpoint?: string;
+}
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  id_token?: string;
+  expires_in?: number;
+  refresh_expires_in?: number;
+}
+
+/** The tokens of the signed-in user, kept for the life of the tab. */
+export interface OidcTokens {
+  accessToken: string;
+  refreshToken?: string;
+  idToken?: string;
+  /** Epoch milliseconds at which the access token stops being valid. */
+  expiresAt: number;
+  /** Epoch milliseconds at which the refresh token stops being valid, when the provider says. */
+  refreshExpiresAt?: number;
+}
+
+/** A sign-in in progress: what must be remembered across the redirect to the provider. */
+interface OidcFlow {
+  state: string;
+  nonce: string;
+  verifier: string;
+}
+
+/** Refresh this long before the access token expires. */
+export const REFRESH_SKEW_MS = 60_000;
+
+/** Tolerated difference between the provider's clock and this browser's, for `exp` and `iat`, in seconds. */
+const CLOCK_SKEW_S = 60;
+
+const DEFAULT_SCOPES = 'openid profile';
+const DEFAULT_REDIRECT_PATH = '/auth/callback';
+const DEFAULT_POST_LOGOUT_PATH = '/login';
+
+/** Why a sign-in could not be completed. The message is for the log, never for the user. */
+export class OidcError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'OidcError';
+  }
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = '';
+  for (const b of bytes) binary += String.fromCodePoint(b);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+
+function randomString(byteLength = 32): string {
+  return base64Url(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+
+/** The S256 code challenge for a verifier (RFC 7636 section 4.2). */
+export async function pkceChallenge(verifier: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+  return base64Url(new Uint8Array(digest));
+}
+
+/** The claims of a JWT. Not verified: only ever applied to an ID token the token endpoint returned. */
+function jwtClaims(jwt: string): Record<string, unknown> {
+  try {
+    const payload = jwt.split('.', 2)[1].replaceAll('-', '+').replaceAll('_', '/');
+    const bytes = Uint8Array.from(
+      atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, '=')),
+      (c) => c.codePointAt(0) ?? 0,
+    );
+    return JSON.parse(new TextDecoder().decode(bytes)) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * OpenID Connect sign-in for a public client: authorization-code flow with PKCE (S256), token
+ * refresh, and RP-initiated logout.
+ *
+ * Written in-house rather than taken from a library, and kept small (see `DOCS/OIDC.md`): it
+ * needs no dependency and no iframe or session-check timers, and it talks to the provider with
+ * `fetch` so that none of this application's HTTP interceptors (which add tenant headers that a
+ * provider's CORS policy refuses) sees the traffic. It does not verify an ID token's signature:
+ * the token is received straight from the token endpoint named by the provider's discovery
+ * document, which OpenID Connect Core section 3.1.3.7 accepts. Fineract validates the access
+ * token on every call.
+ *
+ * Tokens live in tab-scoped storage and are cleared by `clearScope('session')` on sign-out.
+ */
+@Injectable({ providedIn: 'root' })
+export class OidcService {
+  private readonly configService = inject(ConfigService);
+  private readonly storage = inject(STORAGE);
+
+  /** Emits when the provider refused a refresh: the session is over and the user must sign in again. */
+  readonly sessionEnded = new Subject<void>();
+
+  private discovery: Promise<DiscoveryDocument> | null = null;
+  private discoveryFor: string | null = null;
+  private refreshing: Promise<void> | null = null;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  /** Bumped by every {@link clear}; a request that started in an earlier generation is dropped. */
+  private generation = 0;
+
+  constructor() {
+    if (this.hasSession()) this.scheduleRefresh();
+  }
+
+  /** The configured provider, or `null` when OIDC sign-in is not configured. */
+  get config(): OidcConfig | null {
+    return this.configService.oidcConfig();
+  }
+
+  /** Whether this tab holds OIDC tokens. */
+  hasSession(): boolean {
+    return !!this.tokens()?.accessToken;
+  }
+
+  /** The current access token, or `null`. Use {@link ensureFresh} first when it must not be about to expire. */
+  getAccessToken(): string | null {
+    return this.tokens()?.accessToken ?? null;
+  }
+
+  /** Redirects the browser to the provider's sign-in page. */
+  async startLogin(): Promise<void> {
+    const cfg = this.requireConfig();
+    const doc = await this.discover();
+    const flow: OidcFlow = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(48),
+    };
+    this.storage.write('oidcFlow', flow);
+    const query = new URLSearchParams({
+      client_id: cfg.clientId,
+      redirect_uri: this.redirectUri(),
+      response_type: 'code',
+      scope: this.scopes(),
+      state: flow.state,
+      nonce: flow.nonce,
+      code_challenge: await pkceChallenge(flow.verifier),
+      code_challenge_method: 'S256',
+    });
+    this.navigate(`${doc.authorization_endpoint}?${query.toString()}`);
+  }
+
+  /**
+   * Finishes a sign-in: checks `state`, exchanges the code (with the PKCE verifier) for tokens,
+   * checks the ID token's `nonce`, issuer and audience, and stores the tokens.
+   *
+   * @param params - the query parameters of the redirect back to this application
+   */
+  async completeLogin(params: URLSearchParams): Promise<void> {
+    const cfg = this.requireConfig();
+    const flow = this.storage.read<OidcFlow | null>('oidcFlow', null);
+    // One attempt per flow: a replayed redirect finds nothing to check against.
+    this.storage.remove('oidcFlow');
+    const providerError = params.get('error');
+    if (providerError) throw new OidcError(`provider returned ${providerError}`, providerError);
+    const code = params.get('code');
+    if (!flow || !code || params.get('state') !== flow.state) {
+      throw new OidcError('missing or mismatched state', 'invalid_state');
+    }
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const doc = await this.discover();
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    const body = await this.tokenRequest(doc, {
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: this.redirectUri(),
+      client_id: cfg.clientId,
+      code_verifier: flow.verifier,
+    });
+    this.validateIdToken(body.id_token, flow.nonce, doc.issuer, cfg.clientId);
+    // A sign-out while the code was being exchanged wins: do not open a session after it.
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    this.store(body, undefined);
+  }
+
+  /**
+   * Checks the ID token of a code exchange (OpenID Connect Core 3.1.3.7). It is required: it is what
+   * `endSession` later sends as `id_token_hint`, without which the provider asks for confirmation
+   * instead of ending the session.
+   *
+   * The signature is deliberately not verified: the token arrives in the back-channel response of
+   * the token endpoint named by the provider's discovery document, over TLS (rule 6 of 3.1.3.7),
+   * and this application takes nothing from it but these claims. Fineract validates the access
+   * token, signature included, on every call.
+   */
+  private validateIdToken(
+    idToken: string | undefined,
+    nonce: string,
+    issuer: string,
+    clientId: string,
+  ): void {
+    if (!idToken) throw new OidcError('the token response has no ID token', 'invalid_id_token');
+    const claims = jwtClaims(idToken);
+    const aud = ([] as unknown[]).concat(claims['aud']);
+    const now = Date.now() / 1000;
+    const exp = Number(claims['exp']);
+    const iat = Number(claims['iat']);
+    const failed = (
+      [
+        ['nonce', claims['nonce'] === nonce],
+        ['issuer', claims['iss'] === issuer],
+        ['audience', aud.includes(clientId)],
+        ['authorized party', claims['azp'] === undefined || claims['azp'] === clientId],
+        ['expiry', Number.isFinite(exp) && exp + CLOCK_SKEW_S >= now],
+        ['issue time', !Number.isFinite(iat) || iat - CLOCK_SKEW_S <= now],
+      ] as const
+    ).find(([, ok]) => !ok);
+    const problem = failed?.[0];
+    if (problem) throw new OidcError(`ID token ${problem} check failed`, 'invalid_id_token');
+  }
+
+  /** The ID token of the signed-in user, or `null`. Read it before clearing the session: sign-out needs it. */
+  getIdToken(): string | null {
+    return this.tokens()?.idToken ?? null;
+  }
+
+  /**
+   * Makes sure the access token is valid for at least {@link REFRESH_SKEW_MS}, refreshing it if
+   * not. Concurrent callers share one refresh. A refusal by the provider ends the session; a
+   * network failure leaves it as it is and rejects, so the request still goes out and Fineract
+   * decides.
+   */
+  ensureFresh(): Promise<void> {
+    const t = this.tokens();
+    if (!t || t.expiresAt - Date.now() > REFRESH_SKEW_MS) return Promise.resolve();
+    this.refreshing ??= this.refresh().finally(() => (this.refreshing = null));
+    return this.refreshing;
+  }
+
+  /**
+   * Signs out at the provider (OpenID Connect RP-Initiated Logout 1.0) and comes back to the
+   * login page. The local tokens are dropped first, so the application is signed out even if the
+   * provider cannot be reached.
+   *
+   * @param idTokenHint - the user's ID token, read by the caller before the session was cleared.
+   *   Always sent as `id_token_hint` together with `post_logout_redirect_uri`: without the hint
+   *   Keycloak shows a confirmation page, and a user who closes it leaves the SSO session alive.
+   *   Defaults to the stored token, for a caller that has not cleared anything yet.
+   */
+  async endSession(idTokenHint?: string | null): Promise<void> {
+    const cfg = this.config;
+    const idToken = idTokenHint ?? this.getIdToken();
+    this.clear();
+    if (!cfg) return;
+    try {
+      const doc = await this.discover();
+      if (!doc.end_session_endpoint) return;
+      const query = new URLSearchParams({
+        client_id: cfg.clientId,
+        post_logout_redirect_uri: this.origin() + (cfg.postLogoutPath ?? DEFAULT_POST_LOGOUT_PATH),
+      });
+      if (idToken) query.set('id_token_hint', idToken);
+      this.navigate(`${doc.end_session_endpoint}?${query.toString()}`);
+    } catch {
+      // The provider is unreachable: the local sign-out above already happened.
+    }
+  }
+
+  /** Drops the tokens and any pending timer, without telling the provider. */
+  clear(): void {
+    // Anything in flight (a refresh, a code exchange) started before this and must not store its result.
+    this.generation++;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    this.storage.remove('oidcTokens');
+    this.storage.remove('oidcFlow');
+  }
+
+  /** Seam for tests: the only place that leaves the application. */
+  protected navigate(url: string): void {
+    window.location.assign(url);
+  }
+
+  protected origin(): string {
+    return window.location.origin;
+  }
+
+  private redirectUri(): string {
+    return this.origin() + (this.requireConfig().redirectPath ?? DEFAULT_REDIRECT_PATH);
+  }
+
+  /** The requested scopes. `offline_access` is dropped: it would make the refresh token outlive sign-out. */
+  private scopes(): string {
+    const asked = (this.requireConfig().scopes ?? DEFAULT_SCOPES).split(/\s+/).filter(Boolean);
+    return asked.filter((s) => s !== 'offline_access').join(' ');
+  }
+
+  private requireConfig(): OidcConfig {
+    const cfg = this.config;
+    if (!cfg) throw new OidcError('OIDC sign-in is not configured', 'not_configured');
+    return cfg;
+  }
+
+  private tokens(): OidcTokens | null {
+    return this.storage.read<OidcTokens | null>('oidcTokens', null);
+  }
+
+  private async refresh(): Promise<void> {
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const t = this.tokens();
+    const cfg = this.config;
+    if (!t || !cfg) return;
+    if (!t.refreshToken || (t.refreshExpiresAt && t.refreshExpiresAt <= Date.now())) {
+      this.endLocally();
+      return;
+    }
+    const doc = await this.discover();
+    if (generation !== this.generation) return;
+    try {
+      const body = await this.tokenRequest(doc, {
+        grant_type: 'refresh_token',
+        refresh_token: t.refreshToken,
+        client_id: cfg.clientId,
+      });
+      // Signed out while the refresh was in flight: drop the answer, or it would restore the session.
+      if (generation !== this.generation) return;
+      this.store(body, t);
+    } catch (e) {
+      if (generation !== this.generation) return;
+      // invalid_grant and friends: the provider session is gone. A network error is not.
+      if (e instanceof OidcError) this.endLocally();

Review Comment:
   **A transient outage signs everyone out.** `tokenRequest` (L414–418) throws `OidcError` for any `!response.ok`, which includes 500, 502 and 503, and an HTML gateway page whose body parses as `{}` and becomes `token_error`. This line then calls `endLocally()`, so a short IdP or proxy blip during a background refresh sends every signed-in teller to `/login?reason=session-expired`. That contradicts the comment above and the docs ("a network failure does not").
   
   Please end the session only on 400 or 401 with `error` ∈ {`invalid_grant`, `invalid_client`, `unauthorized_client`}; treat 5xx and unparseable responses like a network error and retry. Please also add a unit test; the current ones cover only a refusal and `fetch` rejecting.



##########
src/app/core/services/oidc.service.ts:
##########
@@ -0,0 +1,460 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Injectable, inject } from '@angular/core';
+import { Subject } from 'rxjs';
+import { STORAGE } from '../adapters';
+import { ConfigService, OidcConfig } from './config.service';
+
+/** The endpoints of the provider that this application uses, read from its discovery document. */
+interface DiscoveryDocument {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  end_session_endpoint?: string;
+}
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  id_token?: string;
+  expires_in?: number;
+  refresh_expires_in?: number;
+}
+
+/** The tokens of the signed-in user, kept for the life of the tab. */
+export interface OidcTokens {
+  accessToken: string;
+  refreshToken?: string;
+  idToken?: string;
+  /** Epoch milliseconds at which the access token stops being valid. */
+  expiresAt: number;
+  /** Epoch milliseconds at which the refresh token stops being valid, when the provider says. */
+  refreshExpiresAt?: number;
+}
+
+/** A sign-in in progress: what must be remembered across the redirect to the provider. */
+interface OidcFlow {
+  state: string;
+  nonce: string;
+  verifier: string;
+}
+
+/** Refresh this long before the access token expires. */
+export const REFRESH_SKEW_MS = 60_000;
+
+/** Tolerated difference between the provider's clock and this browser's, for `exp` and `iat`, in seconds. */
+const CLOCK_SKEW_S = 60;
+
+const DEFAULT_SCOPES = 'openid profile';
+const DEFAULT_REDIRECT_PATH = '/auth/callback';
+const DEFAULT_POST_LOGOUT_PATH = '/login';
+
+/** Why a sign-in could not be completed. The message is for the log, never for the user. */
+export class OidcError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'OidcError';
+  }
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = '';
+  for (const b of bytes) binary += String.fromCodePoint(b);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+
+function randomString(byteLength = 32): string {
+  return base64Url(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+
+/** The S256 code challenge for a verifier (RFC 7636 section 4.2). */
+export async function pkceChallenge(verifier: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+  return base64Url(new Uint8Array(digest));
+}
+
+/** The claims of a JWT. Not verified: only ever applied to an ID token the token endpoint returned. */
+function jwtClaims(jwt: string): Record<string, unknown> {
+  try {
+    const payload = jwt.split('.', 2)[1].replaceAll('-', '+').replaceAll('_', '/');
+    const bytes = Uint8Array.from(
+      atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, '=')),
+      (c) => c.codePointAt(0) ?? 0,
+    );
+    return JSON.parse(new TextDecoder().decode(bytes)) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * OpenID Connect sign-in for a public client: authorization-code flow with PKCE (S256), token
+ * refresh, and RP-initiated logout.
+ *
+ * Written in-house rather than taken from a library, and kept small (see `DOCS/OIDC.md`): it
+ * needs no dependency and no iframe or session-check timers, and it talks to the provider with
+ * `fetch` so that none of this application's HTTP interceptors (which add tenant headers that a
+ * provider's CORS policy refuses) sees the traffic. It does not verify an ID token's signature:
+ * the token is received straight from the token endpoint named by the provider's discovery
+ * document, which OpenID Connect Core section 3.1.3.7 accepts. Fineract validates the access
+ * token on every call.
+ *
+ * Tokens live in tab-scoped storage and are cleared by `clearScope('session')` on sign-out.
+ */
+@Injectable({ providedIn: 'root' })
+export class OidcService {
+  private readonly configService = inject(ConfigService);
+  private readonly storage = inject(STORAGE);
+
+  /** Emits when the provider refused a refresh: the session is over and the user must sign in again. */
+  readonly sessionEnded = new Subject<void>();
+
+  private discovery: Promise<DiscoveryDocument> | null = null;
+  private discoveryFor: string | null = null;
+  private refreshing: Promise<void> | null = null;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  /** Bumped by every {@link clear}; a request that started in an earlier generation is dropped. */
+  private generation = 0;
+
+  constructor() {
+    if (this.hasSession()) this.scheduleRefresh();
+  }
+
+  /** The configured provider, or `null` when OIDC sign-in is not configured. */
+  get config(): OidcConfig | null {
+    return this.configService.oidcConfig();
+  }
+
+  /** Whether this tab holds OIDC tokens. */
+  hasSession(): boolean {
+    return !!this.tokens()?.accessToken;
+  }
+
+  /** The current access token, or `null`. Use {@link ensureFresh} first when it must not be about to expire. */
+  getAccessToken(): string | null {
+    return this.tokens()?.accessToken ?? null;
+  }
+
+  /** Redirects the browser to the provider's sign-in page. */
+  async startLogin(): Promise<void> {
+    const cfg = this.requireConfig();
+    const doc = await this.discover();
+    const flow: OidcFlow = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(48),
+    };
+    this.storage.write('oidcFlow', flow);
+    const query = new URLSearchParams({
+      client_id: cfg.clientId,
+      redirect_uri: this.redirectUri(),
+      response_type: 'code',
+      scope: this.scopes(),
+      state: flow.state,
+      nonce: flow.nonce,
+      code_challenge: await pkceChallenge(flow.verifier),
+      code_challenge_method: 'S256',
+    });
+    this.navigate(`${doc.authorization_endpoint}?${query.toString()}`);
+  }
+
+  /**
+   * Finishes a sign-in: checks `state`, exchanges the code (with the PKCE verifier) for tokens,
+   * checks the ID token's `nonce`, issuer and audience, and stores the tokens.
+   *
+   * @param params - the query parameters of the redirect back to this application
+   */
+  async completeLogin(params: URLSearchParams): Promise<void> {
+    const cfg = this.requireConfig();
+    const flow = this.storage.read<OidcFlow | null>('oidcFlow', null);
+    // One attempt per flow: a replayed redirect finds nothing to check against.
+    this.storage.remove('oidcFlow');
+    const providerError = params.get('error');
+    if (providerError) throw new OidcError(`provider returned ${providerError}`, providerError);
+    const code = params.get('code');
+    if (!flow || !code || params.get('state') !== flow.state) {
+      throw new OidcError('missing or mismatched state', 'invalid_state');
+    }
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const doc = await this.discover();
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    const body = await this.tokenRequest(doc, {
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: this.redirectUri(),
+      client_id: cfg.clientId,
+      code_verifier: flow.verifier,
+    });
+    this.validateIdToken(body.id_token, flow.nonce, doc.issuer, cfg.clientId);
+    // A sign-out while the code was being exchanged wins: do not open a session after it.
+    if (generation !== this.generation)
+      throw new OidcError('signed out during sign-in', 'cancelled');
+    this.store(body, undefined);
+  }
+
+  /**
+   * Checks the ID token of a code exchange (OpenID Connect Core 3.1.3.7). It is required: it is what
+   * `endSession` later sends as `id_token_hint`, without which the provider asks for confirmation
+   * instead of ending the session.
+   *
+   * The signature is deliberately not verified: the token arrives in the back-channel response of
+   * the token endpoint named by the provider's discovery document, over TLS (rule 6 of 3.1.3.7),
+   * and this application takes nothing from it but these claims. Fineract validates the access
+   * token, signature included, on every call.
+   */
+  private validateIdToken(
+    idToken: string | undefined,
+    nonce: string,
+    issuer: string,
+    clientId: string,
+  ): void {
+    if (!idToken) throw new OidcError('the token response has no ID token', 'invalid_id_token');
+    const claims = jwtClaims(idToken);
+    const aud = ([] as unknown[]).concat(claims['aud']);
+    const now = Date.now() / 1000;
+    const exp = Number(claims['exp']);
+    const iat = Number(claims['iat']);
+    const failed = (
+      [
+        ['nonce', claims['nonce'] === nonce],
+        ['issuer', claims['iss'] === issuer],
+        ['audience', aud.includes(clientId)],
+        ['authorized party', claims['azp'] === undefined || claims['azp'] === clientId],
+        ['expiry', Number.isFinite(exp) && exp + CLOCK_SKEW_S >= now],
+        ['issue time', !Number.isFinite(iat) || iat - CLOCK_SKEW_S <= now],
+      ] as const
+    ).find(([, ok]) => !ok);
+    const problem = failed?.[0];
+    if (problem) throw new OidcError(`ID token ${problem} check failed`, 'invalid_id_token');
+  }
+
+  /** The ID token of the signed-in user, or `null`. Read it before clearing the session: sign-out needs it. */
+  getIdToken(): string | null {
+    return this.tokens()?.idToken ?? null;
+  }
+
+  /**
+   * Makes sure the access token is valid for at least {@link REFRESH_SKEW_MS}, refreshing it if
+   * not. Concurrent callers share one refresh. A refusal by the provider ends the session; a
+   * network failure leaves it as it is and rejects, so the request still goes out and Fineract
+   * decides.
+   */
+  ensureFresh(): Promise<void> {
+    const t = this.tokens();
+    if (!t || t.expiresAt - Date.now() > REFRESH_SKEW_MS) return Promise.resolve();
+    this.refreshing ??= this.refresh().finally(() => (this.refreshing = null));
+    return this.refreshing;
+  }
+
+  /**
+   * Signs out at the provider (OpenID Connect RP-Initiated Logout 1.0) and comes back to the
+   * login page. The local tokens are dropped first, so the application is signed out even if the
+   * provider cannot be reached.
+   *
+   * @param idTokenHint - the user's ID token, read by the caller before the session was cleared.
+   *   Always sent as `id_token_hint` together with `post_logout_redirect_uri`: without the hint
+   *   Keycloak shows a confirmation page, and a user who closes it leaves the SSO session alive.
+   *   Defaults to the stored token, for a caller that has not cleared anything yet.
+   */
+  async endSession(idTokenHint?: string | null): Promise<void> {
+    const cfg = this.config;
+    const idToken = idTokenHint ?? this.getIdToken();
+    this.clear();
+    if (!cfg) return;
+    try {
+      const doc = await this.discover();
+      if (!doc.end_session_endpoint) return;
+      const query = new URLSearchParams({
+        client_id: cfg.clientId,
+        post_logout_redirect_uri: this.origin() + (cfg.postLogoutPath ?? DEFAULT_POST_LOGOUT_PATH),
+      });
+      if (idToken) query.set('id_token_hint', idToken);
+      this.navigate(`${doc.end_session_endpoint}?${query.toString()}`);
+    } catch {
+      // The provider is unreachable: the local sign-out above already happened.
+    }
+  }
+
+  /** Drops the tokens and any pending timer, without telling the provider. */
+  clear(): void {
+    // Anything in flight (a refresh, a code exchange) started before this and must not store its result.
+    this.generation++;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    this.storage.remove('oidcTokens');
+    this.storage.remove('oidcFlow');
+  }
+
+  /** Seam for tests: the only place that leaves the application. */
+  protected navigate(url: string): void {
+    window.location.assign(url);
+  }
+
+  protected origin(): string {
+    return window.location.origin;
+  }
+
+  private redirectUri(): string {
+    return this.origin() + (this.requireConfig().redirectPath ?? DEFAULT_REDIRECT_PATH);
+  }
+
+  /** The requested scopes. `offline_access` is dropped: it would make the refresh token outlive sign-out. */
+  private scopes(): string {
+    const asked = (this.requireConfig().scopes ?? DEFAULT_SCOPES).split(/\s+/).filter(Boolean);
+    return asked.filter((s) => s !== 'offline_access').join(' ');
+  }
+
+  private requireConfig(): OidcConfig {
+    const cfg = this.config;
+    if (!cfg) throw new OidcError('OIDC sign-in is not configured', 'not_configured');
+    return cfg;
+  }
+
+  private tokens(): OidcTokens | null {
+    return this.storage.read<OidcTokens | null>('oidcTokens', null);
+  }
+
+  private async refresh(): Promise<void> {
+    // Read before the first await: a sign-out during discovery must count.
+    const generation = this.generation;
+    const t = this.tokens();
+    const cfg = this.config;
+    if (!t || !cfg) return;
+    if (!t.refreshToken || (t.refreshExpiresAt && t.refreshExpiresAt <= Date.now())) {
+      this.endLocally();
+      return;
+    }
+    const doc = await this.discover();
+    if (generation !== this.generation) return;
+    try {
+      const body = await this.tokenRequest(doc, {
+        grant_type: 'refresh_token',
+        refresh_token: t.refreshToken,
+        client_id: cfg.clientId,
+      });
+      // Signed out while the refresh was in flight: drop the answer, or it would restore the session.
+      if (generation !== this.generation) return;
+      this.store(body, t);
+    } catch (e) {
+      if (generation !== this.generation) return;
+      // invalid_grant and friends: the provider session is gone. A network error is not.
+      if (e instanceof OidcError) this.endLocally();
+      throw e;
+    }
+  }
+
+  private endLocally(): void {
+    this.clear();
+    this.sessionEnded.next();
+  }
+
+  private store(body: TokenResponse, previous: OidcTokens | undefined): void {
+    const now = Date.now();
+    const tokens: OidcTokens = {
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token ?? previous?.refreshToken,
+      idToken: body.id_token ?? previous?.idToken,
+      expiresAt: now + (body.expires_in ?? 60) * 1000,
+      refreshExpiresAt: body.refresh_expires_in
+        ? now + body.refresh_expires_in * 1000
+        : previous?.refreshExpiresAt,
+    };
+    this.storage.write('oidcTokens', tokens);
+    this.scheduleRefresh();
+  }
+
+  private scheduleRefresh(delayOverride?: number): void {
+    if (this.timer) clearTimeout(this.timer);
+    const t = this.tokens();
+    if (!t) return;
+    const delay = delayOverride ?? Math.max(t.expiresAt - Date.now() - REFRESH_SKEW_MS, 1000);
+    this.timer = setTimeout(() => {
+      // A refresh that failed on the network is tried again shortly, while the token is still good.
+      this.ensureFresh().catch(() => {
+        if (this.hasSession()) this.scheduleRefresh(10_000);
+      });
+    }, delay);
+  }
+
+  private async tokenRequest(
+    doc: DiscoveryDocument,
+    form: Record<string, string>,
+  ): Promise<TokenResponse> {
+    const response = await fetch(doc.token_endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+      body: new URLSearchParams(form).toString(),
+      credentials: 'omit',
+    });
+    const json = (await response.json().catch(() => ({}))) as Partial<TokenResponse> & {
+      error?: string;
+    };
+    if (!response.ok || !json.access_token) {
+      throw new OidcError(
+        `token endpoint answered ${response.status}`,
+        json.error ?? 'token_error',
+      );
+    }
+    return json as TokenResponse;
+  }
+
+  /** Reads the provider's discovery document once per issuer, and refuses endpoints on another origin. */
+  private discover(): Promise<DiscoveryDocument> {
+    const issuer = this.requireConfig().issuer.replace(/\/+$/, '');
+    if (!this.discovery || this.discoveryFor !== issuer) {
+      this.discoveryFor = issuer;
+      this.discovery = this.loadDiscovery(issuer).catch((e: unknown) => {
+        this.discovery = null;
+        throw e;
+      });
+    }
+    return this.discovery;
+  }
+
+  private async loadDiscovery(issuer: string): Promise<DiscoveryDocument> {
+    const response = await fetch(`${issuer}/.well-known/openid-configuration`, {
+      credentials: 'omit',
+    });
+    if (!response.ok) throw new OidcError(`discovery answered ${response.status}`, 'discovery');
+    const doc = (await response.json()) as DiscoveryDocument;
+    const origin = new URL(issuer).origin;
+    const sameOrigin = (u?: string): boolean => {
+      try {
+        return !u || new URL(u).origin === origin;
+      } catch {
+        return false;
+      }
+    };
+    if (
+      doc.issuer !== issuer ||

Review Comment:
   Interoperability:
   - **Trailing-slash issuers.** L425 strips trailing slashes from the configured issuer, then this compares it to `doc.issuer`, which must match exactly. Providers that publish a trailing slash, e.g. Auth0's `"issuer": "https://tenant.auth0.com/"`, can never pass. Please compare against the configured value as-is, and normalise only the URL used to build `.well-known`.
   - **Endpoint origins.** The same-origin requirement on every endpoint (L454) rules out providers whose token endpoint lives on another host (e.g. Google's `oauth2.googleapis.com`). Either allow an explicit `allowedEndpointOrigins`, or state the limitation in `OIDC.md`.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org