[I] RBAC: Working Capital loan actions are gated on UPDATE_WORKINGCAPITALLOAN, not the per-command codes Fineract enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal opened a new issue, #777:
URL: https://github.com/apache/fineract-backoffice-ui/issues/777

   ## Summary
   
   Fineract authorises each Working Capital loan command with its own permission code (for example `APPROVE_WORKINGCAPITALLOAN` or `DISBURSE_WORKINGCAPITALLOAN`). This UI instead guards every action route with the single code `UPDATE_WORKINGCAPITALLOAN`, and renders the action buttons on the loan screen with no permission check at all. That produces two failures:
   
   - **Locked out wrongly.** An approver who holds `APPROVE_WORKINGCAPITALLOAN` but not `UPDATE_WORKINGCAPITALLOAN` is sent to `/forbidden`, although Fineract would accept the approval.
   - **Offered an action the server refuses.** A user who holds `UPDATE_WORKINGCAPITALLOAN` (or only read access) still sees Approve, Disburse, Reject, Undo, Mark as fraud, Waive charge, Delete, Detach originator and the rest. Fineract then answers 403.
   
   Regular loans had the same problem and fixed it with a per-command map (#691). Working Capital needs the equivalent.
   
   ## Evidence (`main` @ `8da1086f`)
   
   - `src/app/features/working-capital/working-capital.routes.ts` guards all of these with `data: { permissions: 'UPDATE_WORKINGCAPITALLOAN' }`: `loans/:id/action/:command`, `loans/:id/charge`, `loans/:id/breach-action`, `loans/:id/near-breach-action` and `loans/:id/delinquency-action`.
   - `src/app/features/working-capital/loans/wc-loan-view.component.ts` contains no `hasPermission` or `[appRequiresPermission]` reference.
     - Its action buttons are always rendered, gated only on loan status: `onRepayment`, `onAction('approve' | 'disburse' | 'reject' | 'undoapproval' | 'undodisbursal' | 'markasfraud' | 'discount' | 'paymentrate')`, `onDelete`, `onAddCharge`, `onWaiveCharge`, the New delinquency / breach / near-breach action buttons, `onAttachOriginator` and `onDetachOriginator`.
     - Delete, Waive and Detach call the API directly from this screen, so no route guard applies to them.
   - `src/app/core/guards/command-permissions.ts` has `LOAN_COMMAND_PERMISSIONS` and `SAVINGS_COMMAND_PERMISSIONS`, but no Working Capital map.
   
   ## Permissions Fineract enforces
   
   All codes below are present in `scripts/permission-codes.json`.
   
   | UI action | Required code |
   |---|---|
   | View loan / tabs | `READ_WORKINGCAPITALLOAN` (or `ALL_FUNCTIONS_READ`) |
   | Create / modify / delete application | `CREATE_` / `UPDATE_` / `DELETE_WORKINGCAPITALLOAN` |
   | Approve / Reject / Undo approval | `APPROVE_` / `REJECT_` / `APPROVALUNDO_WORKINGCAPITALLOAN` |
   | Disburse / Undo disbursal | `DISBURSE_` / `DISBURSALUNDO_WORKINGCAPITALLOAN` |
   | Repayment | `REPAYMENT_WORKINGCAPITALLOAN` |
   | Mark as fraud | `SETFRAUD_WORKINGCAPITALLOAN` |
   | Update discount | `UPDATEDISCOUNT_WORKINGCAPITALLOAN` |
   | Change payment rate | `UPDATERATE_WORKINGCAPITALLOAN` |
   | Add / waive / adjust charge | `CREATE_` / `WAIVE_` / `ADJUSTMENT_WORKINGCAPITALLOANCHARGE` |
   | Delinquency action (pause/resume/reschedule) | `CREATE_WC_DELINQUENCY_ACTION` |
   | Delinquency reset / undo reset | `CREATE_WC_DELINQUENCY_RESET` |
   | Delinquency disable / enable | `CREATE_WC_DELINQUENCY_DISABLE` |
   | Breach action / reset / disable | `CREATE_WC_BREACH_ACTION` / `CREATE_WC_BREACH_RESET` / `CREATE_WC_BREACH_DISABLE` |
   | Near-breach action | `CREATE_WC_NEAR_BREACH_ACTION` |
   | Attach / detach originator | `ATTACH_` / `DETACH_WORKING_CAPITAL_LOAN_ORIGINATOR` |
   
   The reset and disable variants are resolved separately in `WorkingCapitalLoanDelinquencyActionApiResource` / `WorkingCapitalLoanBreachActionApiResource` (`*_RESOURCE_NAME_FOR_PERMISSIONS`). One "New action" form therefore needs a different code depending on the action type the user picks.
   
   Every write also passes with `ALL_FUNCTIONS`. With maker-checker on, the command is queued for the matching `_CHECKER` code, and the UI should say "submitted for approval".
   
   ## Suggested role allowances
   
   These are typical separations of duty, not prescriptive:
   
   | Role | Allowed |
   |---|---|
   | Loan officer | READ, CREATE/UPDATE application, REPAYMENT, CREATE charge, ATTACH originator |
   | Credit approver / branch manager | APPROVE, REJECT, APPROVALUNDO, DISBURSE, DISBURSALUNDO, WAIVE/ADJUSTMENT charge, delinquency/breach actions |
   | Risk / collections | SETFRAUD, UPDATERATE, delinquency reset/disable, breach reset/disable |
   | Auditor | READ only (`ALL_FUNCTIONS_READ`), with no enabled controls |
   
   ## Proposed fix
   
   1. Add `WORKING_CAPITAL_COMMAND_PERMISSIONS` to `command-permissions.ts`, plus a `wcCommandPermission` resolver. Use it on `loans/:id/action/:command`, as `loanCommandPermission` is used for regular loans.
   2. Guard the charge, breach, near-breach and delinquency routes with their own codes. Inside the delinquency and breach forms, disable action types whose reset or disable code the user lacks.
   3. Wrap every action button and menu item in `wc-loan-view` with `[appRequiresPermission]` using the same code. This includes Delete, Waive charge and Detach originator, which call the API directly.
   4. Add unit tests for each mapping, for a user with only `APPROVE_WORKINGCAPITALLOAN` (can approve), and for one with only `UPDATE_WORKINGCAPITALLOAN` (cannot approve). Extend the RBAC e2e spec with a read-only user on a Working Capital loan.
   
   ## Acceptance criteria
   
   - [ ] Each Working Capital action is offered only when the user holds the code Fineract checks for it.
   - [ ] A user holding a specific code but not `UPDATE_WORKINGCAPITALLOAN` can perform that action.
   - [ ] A read-only user sees no enabled write controls on a Working Capital loan.
   - [ ] `scripts/check-route-permissions.mjs` and `scripts/check-permission-codes.mjs` pass.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] RBAC: Working Capital loan actions are gated on UPDATE_WORKINGCAPITALLOAN, not the per-command codes Fineract enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal commented on issue #777:
URL: https://github.com/apache/fineract-backoffice-ui/issues/777#issuecomment-6211182790

   ## Permission check flow (proposed)
   
   ```mermaid
   sequenceDiagram
       actor U as User
       participant R as Route guard
       participant V as WC loan view
       participant F as Fineract
       U->>V: Open loan (READ_WORKINGCAPITALLOAN)
       V->>V: For each action, hasPermission(code for that command)
       V-->>U: Show only actions the user can perform
       U->>R: Click Approve
       R->>R: wcCommandPermission(approve) = APPROVE_WORKINGCAPITALLOAN
       alt user holds code or ALL_FUNCTIONS
           R->>F: POST /working-capital-loans/{id}?command=approve
           F-->>U: 200, or queued for APPROVE_WORKINGCAPITALLOAN_CHECKER
       else missing code
           R-->>U: /forbidden (never reaches Fineract)
       end
   ```
   
   ## What each role should see (mockup)
   
   ```text
   Loan officer (READ, CREATE/UPDATE application, REPAYMENT, CREATE charge)
   ┌ WC Loan #000123 · Active ────────────────────────────────────────────────┐
   │ [Repayment]  [+ Add charge]                    [⋮]  ├ Attach originator  │
   └──────────────────────────────────────────────────────────────────────────┘
   
   Credit approver (APPROVE, REJECT, APPROVALUNDO, DISBURSE, DISBURSALUNDO, WAIVE charge)
   ┌ WC Loan #000124 · Submitted ─────────────────────────────────────────────┐
   │ [Approve] [Reject]                             [⋮]  ├ Undo approval      │
   └──────────────────────────────────────────────────────────────────────────┘
   
   Auditor (ALL_FUNCTIONS_READ)
   ┌ WC Loan #000123 · Active ────────────────────────────────────────────────┐
   │ (no action buttons; all tabs readable)                                   │
   └──────────────────────────────────────────────────────────────────────────┘
   
   Today: all three users see the same full button set, and the action routes accept
   only UPDATE_WORKINGCAPITALLOAN.
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] RBAC: Working Capital loan actions are gated on UPDATE_WORKINGCAPITALLOAN, not the per-command codes Fineract enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal closed issue #777: RBAC: Working Capital loan actions are gated on UPDATE_WORKINGCAPITALLOAN, not the per-command codes Fineract enforces
URL: https://github.com/apache/fineract-backoffice-ui/issues/777


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org