[I] Prevent customer JWTs from accessing staff loan application endpoints [fineract-loan-origination]

["KRYSTALM7 (via GitHub)" <gi...@apache.org>]

KRYSTALM7 opened a new issue, #152:
URL: https://github.com/apache/fineract-loan-origination/issues/152

   ## Problem
   
   Customer-authenticated users can access endpoints under the staff loan application API using a valid customer JWT.
   
   In particular:
   
   `GET /api/v1/loan-applications/{applicationRef}/staff-detail`
   
   accepts a customer JWT and returns the full staff-facing application details.
   
   The response can contain sensitive applicant and loan information such as:
   
   - Applicant name
   - National ID
   - Monthly income
   - Existing loan obligations
   - Credit score
   - Fineract client/loan identifiers
   - Approval stages
   - Approver identities
   - Approval decisions, notes and timestamps
   
   The endpoint is intended to be available only to authenticated staff users.
   
   ## Runtime Evidence
   
   A customer JWT was used against:
   
   `GET /api/v1/loan-applications/LOS-2026-00023/staff-detail`
   
   The endpoint returned `HTTP 200` with staff-level application information.
   
   ## Root Cause
   
   `LoanApplicationController.getStaffDetail()` does not currently enforce a staff-role restriction.
   
   The staff security filter chain only requires:
   
   `authenticated()`
   
   rather than requiring `ROLE_STAFF`.
   
   Additionally, the service method retrieves the application using tenant information but does not perform an authorization check against the caller.
   
   ## Impact
   
   A registered customer may access sensitive information belonging to other applicants in the same tenant if they know or can determine an application reference.
   
   Application references also follow a predictable format, increasing the risk of enumeration.
   
   ## Proposed Fix
   
   - Restrict `LoanApplicationController` to staff users.
   - Add an explicit staff route rule for `/api/v1/loan-applications/**`.
   - Ensure customer JWTs receive `403 Forbidden`.
   - Add regression tests covering customer and staff access.
   
   ## Acceptance Criteria
   
   - [ ] Customer JWT receives `403 Forbidden` for `/api/v1/loan-applications/{ref}/staff-detail`.
   - [ ] No application data is returned in the denied response.
   - [ ] Loan Officer JWT can access the endpoint.
   - [ ] Branch Manager JWT can access the endpoint.
   - [ ] Customer JWT cannot access any endpoint exposed by `LoanApplicationController`.
   
   ## Regression Tests
   
   - [ ] Customer token → staff detail → `403`
   - [ ] Loan Officer token → staff detail → `200`
   - [ ] Branch Manager token → staff detail → `200`
   - [ ] Customer token → staff application list → `403`


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Prevent customer JWTs from accessing staff loan application endpoints [fineract-loan-origination]

["KRYSTALM7 (via GitHub)" <gi...@apache.org>]

KRYSTALM7 commented on issue #152:
URL: https://github.com/apache/fineract-loan-origination/issues/152#issuecomment-6058610834

   I’ll take ownership of this issue and address the authorization gap in the staff loan application APIs.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Prevent customer JWTs from accessing staff loan application endpoints [fineract-loan-origination]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal closed issue #152: Prevent customer JWTs from accessing staff loan application endpoints
URL: https://github.com/apache/fineract-loan-origination/issues/152


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org