[PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal opened a new pull request, #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695

   Closes #691. Closes #665.
   
   Six gates named a permission that cannot authorise what the control does. Each one was measured against a running Fineract with an **empty body**, which separates authorisation from validation without writing anything — the platform authorises before it validates, so `403` means the code is wrong and `400` means it is right and only the body was bad.
   
   ## 1. Dispatch routes declared one code for many commands (#691)
   
   ```
   /loans/:loanId/transactions/:type              UPDATE_LOAN          (29 commands)
   /products/savings-accounts/.../:command        UPDATE_SAVINGSACCOUNT
   ```
   
   Both are in Fineract's `portfolio` grouping; the commands they serve are in `transaction_loan` and `transaction_savings`. So the declaration was wrong for **every** command, in **both** directions:
   
   | Account holds | Platform | The route |
   | --- | --- | --- |
   | `DISBURSE_LOAN` | 400 authorised | **refused** → `/forbidden` |
   | `REPAYMENT_LOAN` | 400 authorised | **refused** |
   | `DEPOSIT_SAVINGSACCOUNT` | 400 authorised | **refused** |
   | `WITHDRAWAL_SAVINGSACCOUNT` | 400 authorised | **refused** |
   | `UPDATE_LOAN` | 403 refused | **admitted** → a form that can only 403 |
   | `UPDATE_SAVINGSACCOUNT` | 403 refused | **admitted** |
   
   The action gates on the buttons were already right, so the two layers contradicted each other: the only control the loan screen offered a disburser led to Access Denied.
   
   `data.permissions` now also accepts a function of the route's params, so the code is resolved from `:type` or `:command`. The 26 entries in `core/guards/command-permissions.ts` were each confirmed at the endpoint the form actually posts to — they are **not** derivable from the command names:
   
   | Command | Code |
   | --- | --- |
   | `withdrawnByClient` | `WITHDRAW_LOAN` |
   | `waiveinterest` | `WAIVEINTERESTPORTION_LOAN` |
   | `close-rescheduled` | `CLOSEASRESCHEDULED_LOAN` |
   | `prepayLoan` | `REPAYMENT_LOAN` — a prepayment *is* a repayment; there is no PREPAY code |
   
   **Four commands are deliberately left unmapped.** The probe gave no clean answer for `undoContractTermination` and `reAmortize` (403 at the endpoint the form uses, 400 at the other URL shape), `undowriteoff` (503), or `postInterestAsOn` (refused for both its apparent code *and* the one the route declared). Those fall through to no client-side gate, the same position `products/:accountType/:accountId/action/:command` is already documented in. A guessed code refuses a user the platform would have allowed, which is the more damaging and less visible half of this bug.
   
   ## 2. The savings cash-withdrawal button asked for the application-withdrawal code
   
   Both codes exist, one letter apart, and they are strictly non-interchangeable:
   
   ```
   transactions?command=withdrawal   WITHDRAWAL_ 400   WITHDRAW_ 403
   ?command=withdrawnByApplicant     WITHDRAWAL_ 403   WITHDRAW_ 400
   ```
   
   `WITHDRAW_SAVINGSACCOUNT` withdraws the *application* — which the Withdrawn-by-applicant button right above it correctly uses. This one withdraws *cash*. A teller holding `WITHDRAWAL_SAVINGSACCOUNT` was shown a disabled button; a holder of the application code was offered an enabled one the platform refuses.
   
   ## 3. Two gates named codes that do not exist
   
   Found by diffing every code the application names against a live `GET /v1/permissions`:
   
   - **`UNDOWITHDRAW_CLIENT`** → `UNDOWITHDRAWAL_CLIENT`. The same missing "AL"; confirmed at 400 against `undoWithdrawal` while `WITHDRAW_CLIENT` answers 403.
   - **`UPDATE_LOAN_AVAILABLE_DISBURSEMENT_AMOUNT`** → no such code, and **no narrower one exists**. Found by bisecting the whole catalogue: a role granted all 721 grantable codes is still refused `PUT /loans/{id}/available-disbursement-amount`, while the superuser gets 400 on the same request. It now declares `ALL_FUNCTIONS`, which is the true requirement and makes the refusal hint name something an administrator can act on.
   
   This is the failure `DOCS/RBAC.md` already warns about — "a gate on a code that does not exist can never be satisfied by any role, which is worse than no gate" — because the control is disabled forever and looks exactly like one the viewer is not entitled to.
   
   ## 4. Office transactions needed the opposite of what #665 proposed
   
   That issue recommended requiring `READ_OFFICETRANSACTION` **and** `READ_OFFICE`. Measuring first showed the transaction code does nothing for these endpoints at all:
   
   ```
   READ_OFFICE alone            → GET /officetransactions 200,  /template 200
   READ_OFFICETRANSACTION alone → 403, 403
   READ_CLIENT alone (control)  → 403, 403
   ```
   
   So an AND would still refuse a `READ_OFFICE` holder the platform serves. The list route and its nav entry now declare `READ_OFFICE`. The create route declares both, since `/officetransactions/template` is also refused without `READ_OFFICE` — a holder of the create code alone reached a form whose office picker could never populate. Writing stays gated separately and correctly on the controls (`CREATE_OFFICETRANSACTION`, `DELETE_OFFICETRANSACTION`), so widening the read does not widen what can be done.
   
   ## Two checks so this class cannot come back
   
   **`check-permission-codes.mjs`** (new, in CI) compares every code named in an action gate, structural gate, route, nav entry, data table or command map against a committed snapshot of the catalogue — so it runs with no Fineract started. 311 codes checked. The snapshot drifts only as Fineract adds codes, which is a false *pass* and never a false failure; `npm run permissions:snapshot` refreshes it.
   
   Its header states what it **cannot** catch: a code that exists but is wrong for the operation, i.e. defect 2 above. Only a run against a real platform separates those. Both halves are written down so nobody mistakes a green check for proof the codes are right.
   
   **`check-route-permissions.mjs`** learns the dynamic form, with a `PER_COMMAND` registry mirroring `UNRESTRICTED`: a dispatch route must be recorded with its reason to be accepted, and the script reads the map it names and fails if that map is missing or empty. Worth noting the old check *passed* on #691 — the route did declare a permission, so it had no way to know the declaration named the wrong code.
   
   ## Verification
   
   - **291 unit test files, 2006 tests passing.** 11 new cases for the dispatch guard (including that `ALL_FUNCTIONS_READ` cannot reach a write command and that an unmapped command admits rather than guesses) and 11 for the map itself.
   - All nine `check:*` scripts pass, plus the new one. `npm run lint`, `prettier --check .` and `tsc` clean for app and e2e.
   - **Mutation-verified, five mutations, each producing a distinct failure**: renaming a dynamic identifier, pointing the registry at a map that does not exist, emptying the map, reintroducing `UNDOWITHDRAW_CLIENT`, and hollowing out the snapshot. A sixth confirms the stated limitation is real — swapping the savings code back to the wrong-but-existing one **passes** the code check.
   - `e2e/loan-flows-non-admin-roles.spec.ts` rewritten to assert the fix: the disburser holding only `DISBURSE_LOAN` drives the payout to Active, and the repayment duty records a repayment — both end to end, because a gate that admits the right user but a form that cannot submit would pass a narrower assertion.
   - `e2e/savings-flows-non-admin-roles.spec.ts` (new) covers `transaction_savings`, which had no coverage at all: an account from application to funded across officer, approver, activator and teller, every role and user built by filling the forms. The cash-withdrawal code is asserted from both sides.
   
   ## One ordering trap worth recording
   
   The editor's test originally asserted the Disburse button was refused. That broke once the disburser actually completed the payout: Disburse is gated on `@if (isLoanApproved)`, so on an active loan it is absent for everyone including a superuser. The assertion would have passed for a reason unrelated to permissions — which is how an assertion keeps passing after the thing it checked has broken. It now asserts Repayment, which *is* offered on an active loan and which that account genuinely lacks the code for.
   
   ## Not changed
   
   **#666** (the Offices screen asking for `includeAllOffices=true`) is left alone. That issue is explicit that it could not establish which behaviour is intended, and the platform answers either way — so it is a product decision, not a defect, and not mine to make inside a bug-fix PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695#issuecomment-5971823099

   <!-- e2e-report-backend -->
   ### E2E — real Fineract
   ## 🎭 E2E Tests
   
   **❌ 1 failing** — 138 passed · 1 failed · 2 skipped · 5 flaky, across 41 spec files in 10m 12s.
   
   ### ❌ Failures
   
   - **the office transactions list › says the list was refused instead of showing an empty table** — `rbac-dead-end-controls.spec.ts`
     - Error: expect(locator).toBeVisible() failed
   
   ### ⚠️ Passed on retry
   
   Green overall, but these needed more than one attempt — the shape a flake takes.
   
   - **Batch API Operations against Fineract › runs the sample batch scenario — create client, create loan, add and read back a charge** — `batch-api-operations.spec.ts` (1 retry/retries)
   - **a client's account tables › withhold the link, but not the number, from a user who cannot open the account** — `rbac-dead-end-controls.spec.ts` (2 retry/retries)
   - **a client's account tables › keep the link for a user who holds READ_LOAN** — `rbac-dead-end-controls.spec.ts` (2 retry/retries)
   - **the office transactions list › withholds Create from a reader, and the route refuses it too** — `rbac-dead-end-controls.spec.ts` (2 retry/retries)
   - **the office transactions list › offers Create to an administrator** — `rbac-dead-end-controls.spec.ts` (2 retry/retries)
   
   ### By spec file
   
   | Spec | ✅ | ❌ | ⏭️ | 🔒 | Time |
   | --- | ---: | ---: | ---: | ---: | ---: |
   | backend.setup.ts | 3 | 0 | 0 | 0 | 6.1s |
   | accounting-closure-backend.spec.ts | 2 | 0 | 0 | 0 | 13.3s |
   | batch-api-operations.spec.ts | 5 | 0 | 0 | 0 | 31.6s |
   | center-servicing.spec.ts | 2 | 0 | 0 | 0 | 18.5s |
   | client-legal-form-search.spec.ts | 1 | 0 | 0 | 0 | 5.4s |
   | client-transfer.spec.ts | 4 | 0 | 0 | 0 | 47.5s |
   | collection-sheet.spec.ts | 1 | 0 | 0 | 0 | 6.1s |
   | deposit-account-servicing.spec.ts | 3 | 0 | 0 | 0 | 26.4s |
   | deposit-product-configuration.spec.ts | 3 | 0 | 0 | 0 | 15.5s |
   | form-layout-reflow.spec.ts | 6 | 0 | 0 | 0 | 32.1s |
   | group-membership.spec.ts | 3 | 0 | 0 | 0 | 48.5s |
   | loan-account-actions.spec.ts | 3 | 0 | 0 | 0 | 24.6s |
   | loan-approved-amount-revision.spec.ts | 3 | 0 | 0 | 0 | 20.7s |
   | loan-charge-off.spec.ts | 2 | 0 | 0 | 0 | 21.5s |
   | loan-flows-non-admin-roles.spec.ts | 8 | 0 | 0 | 0 | 1m 40s |
   | loan-product-accounting.spec.ts | 1 | 0 | 0 | 0 | 33.4s |
   | loan-repayment-gating.spec.ts | 2 | 0 | 0 | 0 | 9.8s |
   | loan-servicing.spec.ts | 2 | 0 | 0 | 0 | 20.2s |
   | login.spec.ts | 4 | 0 | 0 | 0 | 5.9s |
   | oidc-login-backend.spec.ts | 2 | 0 | 0 | 0 | 4.5s |
   | parity-screens.spec.ts | 8 | 0 | 0 | 0 | 44.8s |
   | rbac-backend-restricted-user.spec.ts | 7 | 0 | 0 | 0 | 36.1s |
   | **rbac-dead-end-controls.spec.ts** | 4 | 1 | 2 | 0 | 45.9s |
   | rbac-disabled-flag-backend.spec.ts | 6 | 0 | 0 | 0 | 28.4s |
   | rbac-multi-permission.spec.ts | 9 | 0 | 0 | 0 | 56.8s |
   | bulk-import-entity-types.spec.ts | 1 | 0 | 0 | 0 | 10.1s |
   | delinquency-configuration.spec.ts | 2 | 0 | 0 | 0 | 20.0s |
   | full-demo.spec.ts | 1 | 0 | 0 | 0 | 1m 3s |
   | interest-rate-charts.spec.ts | 1 | 0 | 0 | 0 | 8.2s |
   | loan-lifecycle.spec.ts | 4 | 0 | 0 | 0 | 2m 2s |
   | loan-schedule-type.spec.ts | 3 | 0 | 0 | 0 | 35.5s |
   | rbac-office-scoped-user.spec.ts | 6 | 0 | 0 | 0 | 27.7s |
   | rbac-permissionless-user.spec.ts | 4 | 0 | 0 | 0 | 21.0s |
   | report-mailing-job.spec.ts | 3 | 0 | 0 | 0 | 19.5s |
   | report-parameter-backend.spec.ts | 4 | 0 | 0 | 0 | 22.9s |
   | savings-flows-non-admin-roles.spec.ts | 7 | 0 | 0 | 0 | 1m 42s |
   | savings-transaction-correction.spec.ts | 1 | 0 | 0 | 0 | 6.9s |
   | savings-transaction-gating.spec.ts | 2 | 0 | 0 | 0 | 7.0s |
   | share-account-servicing.spec.ts | 2 | 0 | 0 | 0 | 17.7s |
   | share-product-accounting.spec.ts | 1 | 0 | 0 | 0 | 26.6s |
   | teller-cash-management.spec.ts | 2 | 0 | 0 | 0 | 38.5s |
   
   <details>
   <summary><b>All 141 tests</b> — click to expand</summary>
   
   **`backend.setup.ts`**
   
   - ✅ seed backend reference data — `1.9s`
   - ✅ seed backend reference data — `2.2s`
   - ✅ seed backend reference data — `2.0s`
   
   **`accounting-closure-backend.spec.ts`**
   
   - ✅ Accounting closures against Fineract › a closed period reads as Closed, and the platform refuses a posting inside it — `7.1s`
   - ✅ Accounting closures against Fineract › the form keeps the user on the page and names the reason when Fineract refuses — `6.2s`
   
   **`batch-api-operations.spec.ts`**
   
   - ✅ Batch API Operations against Fineract › runs the sample batch scenario — create client, create loan, add and read back a charge — `9.3s` _(retried 1×)_
   - ✅ Batch API Operations against Fineract › shows a parse error instead of submitting when the batch input is not valid JSON — `6.5s`
   - ✅ Batch API enclosingTransaction semantics against Fineract › rolls back the earlier steps when enclosingTransaction is true and a later step fails — `5.3s`
   - ✅ Batch API enclosingTransaction semantics against Fineract › does not roll back the earlier steps when enclosingTransaction is false and a later step fails — `5.1s`
   - ✅ Batch API Operations on a mobile viewport against Fineract › the sample batch scenario is reachable and works by touch at mobile width — `5.5s`
   
   **`center-servicing.spec.ts`**
   
   - ✅ Center servicing › a center is activated, staffed and given a group — `12.4s`
   - ✅ Center servicing › notes are recorded against the center — `6.1s`
   
   **`client-legal-form-search.spec.ts`**
   
   - ✅ Client list: legal form filtering › an entity client appears in the main client list — `5.4s`
   
   **`client-transfer.spec.ts`**
   
   - ✅ Client transfer between offices › a proposed transfer is held until the destination accepts, and then the client moves — `11.8s`
   - ✅ Client transfer between offices › a rejected transfer leaves the client on hold, and withdrawing is the way back — `13.2s`
   - ✅ Client transfer between offices › a client can be transferred in one step when the user may act for both offices — `10.6s`
   - ✅ Client staff assignment › an officer can be assigned and then removed — `11.9s`
   
   **`collection-sheet.spec.ts`**
   
   - ✅ Collection Sheet › scopes staff to the office, sends the choice, and reports an empty sheet — `6.1s`
   
   **`deposit-account-servicing.spec.ts`**
   
   - ✅ Term deposit account servicing › an account is approved, activated and closed before maturity — `11.4s`
   - ✅ Term deposit account servicing › a deposit is recorded, listed, and reversed without leaving the list — `8.3s`
   - ✅ Term deposit account servicing › an application can be rejected instead of approved — `6.8s`
   
   **`deposit-product-configuration.spec.ts`**
   
   - ✅ Deposit product configuration › a fixed deposit product survives being edited — `5.2s`
   - ✅ Deposit product configuration › a recurring deposit product can be created at all — `4.9s`
   - ✅ Deposit product configuration › a savings product carries its accounting configuration — `5.5s`
   
   **`form-layout-reflow.spec.ts`**
   
   - ✅ form layout at the narrow viewport › Create GL Account gives every field a usable width at 320px — `4.2s`
   - ✅ form layout at the narrow viewport › Create Loan gives every field a usable width at 320px — `4.7s`
   - ✅ form layout at the narrow viewport › Create Office gives every field a usable width at 320px — `5.1s`
   - ✅ form layout at the narrow viewport › Create Staff gives every field a usable width at 320px — `4.8s`
   - ✅ form layout at the narrow viewport › no page-level horizontal scroll at 320px — `9.0s`
   - ✅ form layout at the wide viewport › Create GL Account still uses more than one column at 1280px — `4.2s`
   
   **`group-membership.spec.ts`**
   
   - ✅ Group membership and lifecycle › a group is activated, staffed, given members and a committee, then emptied — `20.2s`
   - ✅ Group membership and lifecycle › notes are recorded against the group and can be removed again — `9.0s`
   - ✅ Group membership and lifecycle › an empty group is closed with a reason, and a group with members is refused — `19.4s`
   
   **`loan-account-actions.spec.ts`**
   
   - ✅ Loan account lifecycle actions › new action menu items appear only for active loans — `7.3s`
   - ✅ Loan account lifecycle actions › undo disbursal shows a confirm dialog and reverts the loan to Approved — `9.0s`
   - ✅ Loan account lifecycle actions › write off requires confirmation and moves the loan out of Active status — `8.3s`
   
   **`loan-approved-amount-revision.spec.ts`**
   
   - ✅ Loan approved and available-disbursement amount revision › revises the approved amount on an active, partially-disbursed loan — `7.3s`
   - ✅ Loan approved and available-disbursement amount revision › revises the available disbursement amount, which also changes the approved amount — `6.7s`
   - ✅ Loan approved and available-disbursement amount revision › shows the platform’s own refusal, not a generic validation message — `6.7s`
   
   **`loan-charge-off.spec.ts`**
   
   - ✅ Loan servicing commands › charges a loan off through the UI and reverses it — `11.4s`
   - ✅ Loan servicing commands › records a goodwill credit through the shared transaction form — `10.0s`
   
   **`loan-flows-non-admin-roles.spec.ts`**
   
   - ✅ a loan taken through four separated duties, every account built in the UI › an administrator builds the four roles and accounts through the forms — `38.3s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the officer books the application and is not offered approval of their own loan — `15.2s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the approver, differing from the officer in one code, is offered it and approves — `5.8s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the approver is not offered disbursement of the loan they just approved — `5.2s`
   - ✅ a loan taken through four separated duties, every account built in the UI › the disburser, holding only DISBURSE_LOAN, completes the payout end to end — `7.5s`
   - ✅ a loan taken through four separated duties, every account built in the UI › and the same route now refuses an UPDATE_LOAN holder, as the platform does — `7.2s`
   - ✅ a loan taken through four separated duties, every account built in the UI › a command with no mapped code is left to the platform rather than guessed at — `5.1s`
   - ✅ a loan taken through four separated duties, every account built in the UI › a repayment duty reaches its own form, and records a repayment — `15.7s`
   
   **`loan-product-accounting.spec.ts`**
   
   - ✅ Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger — `33.4s`
   
   **`loan-repayment-gating.spec.ts`**
   
   - ✅ Repayment is offered only where the platform allows it › withheld on a loan awaiting approval, offered once it is active — `9.4s`
   - ✅ Repayment is offered only where the platform allows it › the platform refuses a repayment on a loan awaiting approval — `389ms`
   
   **`loan-servicing.spec.ts`**
   
   - ✅ Loan servicing: notes and transaction adjustment › notes can be added and removed, with a confirm dialog on delete — `9.1s`
   - ✅ Loan servicing: notes and transaction adjustment › a repayment transaction can be viewed and adjusted with a corrected amount — `11.1s`
   
   **`login.spec.ts`**
   
   - ✅ Login › login page displays correctly — `1.4s`
   - ✅ Login › login form has required fields — `1.5s`
   - ✅ Login › submit button is disabled when form is empty — `1.4s`
   - ✅ Login › submit button is enabled when form is filled — `1.6s`
   
   **`oidc-login-backend.spec.ts`**
   
   - ✅ identity-provider route against a real Fineract › is offered beside the password form, and pressing it sends nothing to Fineract — `1.4s`
   - ✅ identity-provider route against a real Fineract › a real password sign-in still gets a session with the route offered — `3.0s`
   
   **`parity-screens.spec.ts`**
   
   - ✅ Screens added for platform parity › a manual journal entry can be read whole and reversed — `5.5s`
   - ✅ Screens added for platform parity › an entry that is already reversed is not offered again — `4.5s`
   - ✅ Screens added for platform parity › a report definition can be created, edited and deleted; a core one cannot — `5.8s`
   - ✅ Screens added for platform parity › a core report opens read-only with only its in-use setting — `4.7s`
   - ✅ Screens added for platform parity › a pending loan is approved from the queue, in a batch — `6.5s`
   - ✅ Screens added for platform parity › a fixed deposit is listed as a deposit, not as a savings account — `5.2s`
   - ✅ Screens added for platform parity › an office has a screen, and it carries its custom fields — `5.7s`
   - ✅ Screens added for platform parity › a savings account carries notes, and the note survives a reload — `6.9s`
   
   **`rbac-backend-restricted-user.spec.ts`**
   
   - ✅ a genuinely restricted Fineract user › holds exactly the permissions their role was granted — `261ms`
   - ✅ a genuinely restricted Fineract user › reaches the screen their permission covers — `5.2s`
   - ✅ a genuinely restricted Fineract user › is refused a screen their permission does not cover, by URL and by the backend — `5.0s`
   - ✅ a genuinely restricted Fineract user › is refused a write screen they can read the list for, and the write itself — `7.1s`
   - ✅ a genuinely restricted Fineract user › is not offered the actions it would be refused for — `4.1s`
   - ✅ a genuinely restricted Fineract user › is shown an action it cannot take, disabled and saying what it needs — `5.9s`
   - ✅ a genuinely restricted Fineract user › the superuser the rest of the suite uses is unaffected — `8.5s`
   
   **`rbac-dead-end-controls.spec.ts`**
   
   - ✅ a client's account tables › withhold the link, but not the number, from a user who cannot open the account — `5.0s` _(retried 2×)_
   - ✅ a client's account tables › keep the link for a user who holds READ_LOAN — `6.2s` _(retried 2×)_
   - ✅ the office transactions list › withholds Create from a reader, and the route refuses it too — `5.6s` _(retried 2×)_
   - ✅ the office transactions list › offers Create to an administrator — `5.2s` _(retried 2×)_
   - ❌ the office transactions list › says the list was refused instead of showing an empty table — `23.8s` _(retried 2×)_
   - ⏭️ a group's member list › names the member without linking when the reader cannot open clients — `0ms` _(retried 2×)_
   - ⏭️ a group's member list › keeps the link for a reader who holds READ_CLIENT — `0ms` _(retried 2×)_
   
   **`rbac-disabled-flag-backend.spec.ts`**
   
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is shown the whole navigation, including modules their role does not cover — `4.1s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is admitted by the route guard to a screen their role does not cover — `7.1s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is still refused by Fineract, which the flag does not reach — `663ms`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › is told the list is beyond their role, and not offered a retry that cannot succeed — `5.6s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › gets the same treatment on a second refused list, not a one-screen fix — `5.4s`
   - ✅ rbacEnabled: false, with a user who holds only READ_CLIENT › still loads the list their role does cover, with no failure state at all — `5.5s`
   
   **`rbac-multi-permission.spec.ts`**
   
   - ✅ a route declaring more than one permission code (OR semantics) › is admitted by either declared code alone — `4.8s`
   - ✅ a route declaring more than one permission code (OR semantics) › is admitted by the other declared code alone — `4.6s`
   - ✅ a route declaring more than one permission code (OR semantics) › is refused when holding neither declared code, by the router and by the backend — `4.6s`
   - ✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › reaches read screens across modules it holds no specific code for — `9.3s`
   - ✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › is refused every write screen, and the writes themselves — `7.6s`
   - ✅ a restricted session across a real page reload › keeps the same permission boundary after reloading, not just after a fresh login — `9.8s`
   - ✅ a second real action-level gate, distinct from loan repayment › is shown the Approve action disabled and naming what it needs, refused by the backend too — `5.4s`
   - ✅ Security module writes (users, roles), against the real backend › reaches the list screens but is refused the write screens — `10.4s`
   - ✅ Security module writes (users, roles), against the real backend › is refused creating a user and modifying a role, by the backend itself — `284ms`
   
   **`bulk-import-entity-types.spec.ts`**
   
   - ✅ every offered entity type is one the platform accepts — `10.1s`
   
   **`delinquency-configuration.spec.ts`**
   
   - ✅ creates a delinquency range, then edits it — `10.8s`
   - ✅ creates a delinquency bucket from the ranges the template offers — `9.2s`
   
   **`full-demo.spec.ts`**
   
   - ✅ Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement — `1m 3s`
   
   **`interest-rate-charts.spec.ts`**
   
   - ✅ lists charts without a server error — `8.2s`
   
   **`loan-lifecycle.spec.ts`**
   
   - ✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan — `32.2s`
   - ✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan — `33.2s`
   - ✅ Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval — `28.5s`
   - ✅ Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden — `28.3s`
   
   **`loan-schedule-type.spec.ts`**
   
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › loan products list shows a schedule type chip per product — `9.5s`
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › create a Progressive loan product end-to-end and verify it round-trips — `14.9s`
   - ✅ Loan Schedule Type (Cumulative vs Progressive) › loan creation shows the schedule type badge for a Progressive product — `11.1s`
   
   **`rbac-office-scoped-user.spec.ts`**
   
   - ✅ an account scoped to a branch office › differs from a head-office account in office alone, not in permissions — `480ms`
   - ✅ an account scoped to a branch office › is shown only its own office in the client list, and told which office it is in — `4.8s`
   - ✅ an account scoped to a branch office › sees a shorter list than an identically-permissioned head-office account — `4.8s`
   - ✅ an account scoped to a branch office › is refused another office’s client by the platform, and told so once — `5.4s`
   - ✅ an account scoped to a branch office › can still open the record that is in its own office — `5.0s`
   - ✅ an account scoped to a branch office › is not offered an edit it would be refused for on the Offices screen — `7.2s`
   
   **`rbac-permissionless-user.spec.ts`**
   
   - ✅ an account whose role grants nothing › is authenticated by Fineract and authorized by it for nothing — `726ms`
   - ✅ an account whose role grants nothing › is signed in and landed on a screen rather than stranded at the login form — `4.5s`
   - ✅ an account whose role grants nothing › is offered no permission-gated module, and refused each one by URL and by Fineract — `10.6s`
   - ✅ an account whose role grants nothing › is left a navigation whose entries actually work — `5.2s`
   
   **`report-mailing-job.spec.ts`**
   
   - ✅ report mailing job creation › is no longer refused for a missing parameter — `6.2s`
   - ✅ report mailing job creation › the payload carries the locale and the schedule — `5.5s`
   - ✅ report mailing job creation at the narrow viewport › every field is reachable and the job still saves at 320px — `7.8s`
   
   **`report-parameter-backend.spec.ts`**
   
   - ✅ Dynamic report parameters against Fineract › keeps the parameter form available when a report has cascading lookups — `4.9s`
   - ✅ Dynamic report parameters against Fineract › changing Office changes the Client Listing row set — `5.8s`
   - ✅ Cascading report parameters against Fineract › sends the parent value to the child lookup and clears the child when it changes — `7.4s`
   - ✅ Chart reports against Fineract › renders a chart report as a chart rather than a table — `4.9s`
   
   **`savings-flows-non-admin-roles.spec.ts`**
   
   - ✅ a savings account taken through four separated duties, every account built in the UI › an administrator builds the five roles and accounts through the forms — `50.5s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the officer books the application and is not offered approval of it — `8.7s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the approver, differing in one code, is offered it and approves — `5.9s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the activator activates, and cannot take a deposit — `7.1s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the teller, holding only the transaction codes, records a deposit end to end — `6.3s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the cash-withdrawal control asks for the cash code, not the application one — `17.4s`
   - ✅ a savings account taken through four separated duties, every account built in the UI › the transaction route refuses an UPDATE_SAVINGSACCOUNT holder, as the platform does — `6.5s`
   
   **`savings-transaction-correction.spec.ts`**
   
   - ✅ Savings transaction correction › a deposit is reversed and a hold is released — `6.9s`
   
   **`savings-transaction-gating.spec.ts`**
   
   - ✅ Savings transactions are offered only on an active account › withheld while awaiting approval, offered once active — `6.8s`
   - ✅ Savings transactions are offered only on an active account › the platform refuses a deposit on an account awaiting approval — `235ms`
   
   **`share-account-servicing.spec.ts`**
   
   - ✅ Share account servicing › an account is approved, activated, traded and closed — `12.1s`
   - ✅ Share account servicing › an application can be rejected — `5.6s`
   
   **`share-product-accounting.spec.ts`**
   
   - ✅ Share product accounting › a share product is mapped to equity and round-trips on edit — `26.6s`
   
   **`teller-cash-management.spec.ts`**
   
   - ✅ Teller cash management › a cashier is listed, receives an allocation, and settles cash back — `26.6s`
   - ✅ Teller cash management › settling more than the cashier holds is refused and the form stays usable — `11.8s`
   
   </details>
   
   <details>
   <summary><b>Slowest 10</b> — what the shard counts should be tuned against</summary>
   
   | Test | Spec | Time |
   | --- | --- | ---: |
   | Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement | `full-demo.spec.ts` | 1m 3s |
   | a savings account taken through four separated duties, every account built in the UI › an administrator builds the five roles and accounts through the forms | `savings-flows-non-admin-roles.spec.ts` | 50.5s |
   | a loan taken through four separated duties, every account built in the UI › an administrator builds the four roles and accounts through the forms | `loan-flows-non-admin-roles.spec.ts` | 38.3s |
   | Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger | `loan-product-accounting.spec.ts` | 33.4s |
   | Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan | `loan-lifecycle.spec.ts` | 33.2s |
   | Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan | `loan-lifecycle.spec.ts` | 32.2s |
   | Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval | `loan-lifecycle.spec.ts` | 28.5s |
   | Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden | `loan-lifecycle.spec.ts` | 28.3s |
   | Share product accounting › a share product is mapped to equity and round-trips on edit | `share-product-accounting.spec.ts` | 26.6s |
   | Teller cash management › a cashier is listed, receives an allocation, and settles cash back | `teller-cash-management.spec.ts` | 26.6s |
   
   </details>
   
   
   📼 [Download the HTML report, videos and traces](https://github.com/apache/fineract-backoffice-ui/actions/runs/37140999867) — see the `playwright-report-backend` artifact.
   
   <sub>Generated by [run 37140999867](https://github.com/apache/fineract-backoffice-ui/actions/runs/37140999867) from `2c27faa`. The run executed a fork branch, so treat its contents as unverified.</sub>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["github-advanced-security[bot] (via GitHub)" <gi...@apache.org>]

github-advanced-security[bot] commented on code in PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695#discussion_r4174121229


##########
scripts/snapshot-permission-codes.mjs:
##########
@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+
+/**
+ * Refreshes `scripts/permission-codes.json` from a running Fineract.
+ *
+ * The catalogue grows between releases, and a stale snapshot is a false *pass* — a new code the
+ * application legitimately names would be reported as invented. It is never a false failure,
+ * since codes are not removed, which is why a snapshot is safe to check against in CI at all.
+ *
+ *   bash scripts/e2e-stack.sh
+ *   npm run permissions:snapshot
+ *
+ * Padded codes are written verbatim. Fineract ships five with a trailing space, and
+ * `READ_STANDINGINSTRUCTION` and `READ_ClientSummary` exist *only* in that form — trimming them
+ * on the way in is what broke the role permission editor (#693), so they are preserved here and
+ * `check-permission-codes.mjs` trims only when comparing.
+ */
+
+import { writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const OUT = join(ROOT, 'scripts/permission-codes.json');
+
+const origin = process.env.FINERACT_BACKEND_ORIGIN ?? 'https://localhost:8443';
+const tenant = process.env.FINERACT_TENANT_ID ?? 'default';
+const username = process.env.FINERACT_USERNAME ?? 'mifos';
+const password = process.env.FINERACT_PASSWORD ?? 'password';
+
+// The local stack serves a self-signed certificate, which is the whole reason this is a script
+// rather than a curl in the README.
+process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Review Comment:
   ## CodeQL / Disabling certificate validation
   
   Disabling certificate validation is strongly discouraged.
   
   [Show more details](https://github.com/apache/fineract-backoffice-ui/security/code-scanning/17)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695#issuecomment-5971822955

   <!-- e2e-report-mocked -->
   ### E2E — mocked backend
   ## 🎭 E2E Tests
   
   **✅ All green** — 409 passed · 0 failed · 1 skipped, across 38 spec files in 6m 10s.
   
   ### By spec file
   
   | Spec | ✅ | ❌ | ⏭️ | 🔒 | Time |
   | --- | ---: | ---: | ---: | ---: | ---: |
   | accessibility.spec.ts | 5 | 0 | 0 | 0 | 33.2s |
   | all-functions-read-shortcut.spec.ts | 5 | 0 | 0 | 0 | 10.2s |
   | branded-deployment.spec.ts | 9 | 0 | 0 | 0 | 18.6s |
   | breadcrumb.spec.ts | 2 | 0 | 0 | 0 | 5.7s |
   | client-date-picker-revisit.spec.ts | 1 | 0 | 0 | 0 | 6.2s |
   | client-servicing-gaps.spec.ts | 14 | 0 | 0 | 0 | 1m 1s |
   | client.spec.ts | 1 | 0 | 0 | 0 | 3.5s |
   | collateral-currency-search.spec.ts | 5 | 0 | 0 | 0 | 16.6s |
   | date-picker-revisit.spec.ts | 6 | 0 | 0 | 0 | 25.5s |
   | deployment-customization.spec.ts | 19 | 0 | 0 | 0 | 37.0s |
   | e2e-journey.spec.ts | 81 | 0 | 0 | 0 | 2m 53s |
   | feature-coverage.spec.ts | 49 | 0 | 0 | 0 | 1m 46s |
   | functional-coverage.spec.ts | 42 | 0 | 0 | 0 | 1m 54s |
   | global-search-nav-shortcuts.spec.ts | 4 | 0 | 0 | 0 | 9.5s |
   | global-search-navigation.spec.ts | 8 | 0 | 0 | 0 | 21.3s |
   | group-detail.spec.ts | 8 | 0 | 0 | 0 | 33.7s |
   | guidance-tour.spec.ts | 5 | 0 | 1 | 0 | 14.2s |
   | keyboard-shortcuts.spec.ts | 5 | 0 | 0 | 0 | 10.2s |
   | list-load-failure.spec.ts | 5 | 0 | 0 | 0 | 19.5s |
   | list-pagination.spec.ts | 13 | 0 | 0 | 0 | 53.5s |
   | loan-delinquency-actions.spec.ts | 11 | 0 | 0 | 0 | 44.1s |
   | loan-portfolio-summary.spec.ts | 4 | 0 | 0 | 0 | 14.5s |
   | loan-product-down-payment.spec.ts | 13 | 0 | 0 | 0 | 1m 1s |
   | charge-refund.spec.ts | 1 | 0 | 0 | 0 | 5.3s |
   | client-empty-account-cta.spec.ts | 1 | 0 | 0 | 0 | 5.7s |
   | client-load-error.spec.ts | 2 | 0 | 0 | 0 | 5.8s |
   | contract-termination.spec.ts | 1 | 0 | 0 | 0 | 6.8s |
   | loan-schedule-type-gating.spec.ts | 6 | 0 | 0 | 0 | 16.8s |
   | loan-servicing-gaps.spec.ts | 18 | 0 | 0 | 0 | 59.0s |
   | logout-reason-notice.spec.ts | 4 | 0 | 0 | 0 | 3.0s |
   | oidc-login.spec.ts | 8 | 0 | 0 | 0 | 10.9s |
   | rbac-feature-flag.spec.ts | 11 | 0 | 0 | 0 | 15.6s |
   | rbac-route-protection.spec.ts | 18 | 0 | 0 | 0 | 1m 25s |
   | report-enhancements.spec.ts | 2 | 0 | 0 | 0 | 6.2s |
   | reporting.spec.ts | 2 | 0 | 0 | 0 | 3.8s |
   | scheduler-jobs.spec.ts | 3 | 0 | 0 | 0 | 9.0s |
   | two-factor-authentication.spec.ts | 10 | 0 | 0 | 0 | 15.4s |
   | working-capital-loan-actions.spec.ts | 7 | 0 | 0 | 0 | 27.2s |
   
   <details>
   <summary><b>All 410 tests</b> — click to expand</summary>
   
   **`accessibility.spec.ts`**
   
   - ✅ Runtime accessibility › client list has no blocking violations — `4.7s`
   - ✅ Runtime accessibility › client list links meet color contrast in dark mode — `4.0s`
   - ✅ Runtime accessibility › client form has no blocking violations — `4.8s`
   - ✅ Runtime accessibility › banner and dashboard content have no blocking violations — `14.9s`
   - ✅ Runtime accessibility › create office dialog has no blocking violations — `4.7s`
   
   **`all-functions-read-shortcut.spec.ts`**
   
   - ✅ ALL_FUNCTIONS_READ shortcut › grants read access to the Clients list without any explicit READ_CLIENT permission — `2.3s`
   - ✅ ALL_FUNCTIONS_READ shortcut › does not grant the Create Client action — `1.9s`
   - ✅ ALL_FUNCTIONS_READ shortcut › does not grant Create Client even combined with an explicit READ_CLIENT permission — `1.9s`
   - ✅ ALL_FUNCTIONS_READ shortcut › a user with the real CREATE_CLIENT permission still sees the button — `1.7s`
   - ✅ ALL_FUNCTIONS_READ shortcut › ALL_FUNCTIONS (full superuser) still sees the Create Client button — `2.3s`
   
   **`branded-deployment.spec.ts`**
   
   - ✅ a fully branded deployment › wears the institution’s name and mark, not Fineract’s — `2.1s`
   - ✅ a fully branded deployment › carries the institution’s palette into its own chrome and into Ionic — `1.7s`
   - ✅ a fully branded deployment › drops the sections the institution does not run — `2.0s`
   - ✅ a fully branded deployment › renames and reorders entries to the institution’s vocabulary — `2.0s`
   - ✅ a fully branded deployment › offers the institution’s own systems beside Fineract’s screens — `2.1s`
   - ✅ a fully branded deployment › restates the labels the institution words differently — `2.1s`
   - ✅ a fully branded deployment › keeps a readable palette in dark mode, with a label colour to match — `1.7s`
   - ✅ a fully branded deployment › does not leak a light colour into the dark palette — `2.1s`
   - ✅ a fully branded deployment › reports no configuration defects for the published example — `3.0s`
   
   **`breadcrumb.spec.ts`**
   
   - ✅ a single-crumb page shows no breadcrumb trail — `2.2s`
   - ✅ a nested page shows a trail, and the ancestor crumb navigates back — `3.5s`
   
   **`client-date-picker-revisit.spec.ts`**
   
   - ✅ Client form date pickers › stay usable on a second visit to the create form — `6.2s`
   
   **`client-servicing-gaps.spec.ts`**
   
   - ✅ Client transfers › proposing a transfer sends the destination, the date and the format that parses it — `4.7s`
   - ✅ Client transfers › a one-step transfer omits the date the platform refuses — `4.7s`
   - ✅ Client transfers › the client’s own office is not offered as a destination — `4.9s`
   - ✅ Client transfers › accepting a transfer sends a note and nothing else — `4.4s`
   - ✅ Client transfers › accepting with no note sends an empty body — `4.2s`
   - ✅ Client transfers › rejecting a transfer is offered while one is pending — `4.5s`
   - ✅ Client transfers › withdrawing is offered from on hold, which is the only way back — `4.5s`
   - ✅ Client transfers › answers to a transfer are not offered when none is pending — `3.5s`
   - ✅ Client staff and default savings account › assigning a member of staff sends the staff id — `4.4s`
   - ✅ Client staff and default savings account › unassigning echoes the current holder back, which the platform requires — `4.9s`
   - ✅ Client staff and default savings account › unassigning is not offered when nobody is assigned — `3.5s`
   - ✅ Client staff and default savings account › the assigned officer is shown on the header — `3.6s`
   - ✅ Client staff and default savings account › setting the default savings account sends the account id — `4.6s`
   - ✅ Undoing a rejection › posts the command name the platform recognises, not the menu identifier — `4.2s`
   
   **`client.spec.ts`**
   
   - ✅ Client Management › should create a new client — `3.5s`
   
   **`collateral-currency-search.spec.ts`**
   
   - ✅ Collateral product currency — searchable select (#​626) › the field is closed with no option list until it is opened — `3.3s`
   - ✅ Collateral product currency — searchable select (#​626) › typing narrows a long, alphabetical list to the matching currency — `3.5s`
   - ✅ Collateral product currency — searchable select (#​626) › matches by currency code as well as by name — `3.1s`
   - ✅ Collateral product currency — searchable select (#​626) › shows a "no results" message rather than an empty panel — `3.4s`
   - ✅ Collateral product currency — searchable select (#​626) › Cancel closes the picker without changing the selection — `3.4s`
   
   **`date-picker-revisit.spec.ts`**
   
   - ✅ Date pickers on revisited forms › office form keeps its pickers usable on every visit — `3.8s`
   - ✅ Date pickers on revisited forms › staff form keeps its pickers usable on every visit — `4.6s`
   - ✅ Date pickers on revisited forms › holiday form keeps its pickers usable on every visit — `4.3s`
   - ✅ Date pickers on revisited forms › teller form keeps its pickers usable on every visit — `3.8s`
   - ✅ Date pickers on revisited forms › accounting closure form keeps its pickers usable on every visit — `4.1s`
   - ✅ Date pickers on revisited forms › floating rate form keeps its pickers usable on every visit — `5.0s`
   
   **`deployment-customization.spec.ts`**
   
   - ✅ with no overlay mounted › boots, keeps the shipped branding, and shows the full menu — `1.7s`
   - ✅ with no overlay mounted › does not ask for an overlay this deployment has not declared — `2.0s`
   - ✅ with no overlay mounted › logs no federation parse error on load — `2.0s`
   - ✅ branding › applies colour and density tokens to the document — `1.7s`
   - ✅ branding › recolours Ionic through the same tokens — `1.9s`
   - ✅ branding › renames the product in the header and the tab title — `3.0s`
   - ✅ branding › serves the deployment logo and names it after the deployment — `2.0s`
   - ✅ branding › refuses a fill that cannot carry the white text baked into the stylesheet — `1.9s`
   - ✅ branding › accepts a light accent and derives a dark label for it — `1.7s`
   - ✅ branding › ignores a token outside the published allow-list, and says so — `2.0s`
   - ✅ navigation › hides an entry named by its id — `2.1s`
   - ✅ navigation › does not hide an entry named by its labelKey — `2.0s`
   - ✅ navigation › renames and reorders entries — `1.7s`
   - ✅ navigation › adds an external entry that opens in a new tab — `2.1s`
   - ✅ navigation › nests an added entry under an existing group — `1.7s`
   - ✅ navigation › gates an added entry on permissions like any built-in one — `2.1s`
   - ✅ navigation › drops an external entry with no usable url rather than rendering a dead link — `2.0s`
   - ✅ layering › merges over config.json instead of replacing it — `1.7s`
   - ✅ layering › a malformed overlay leaves the application usable — `1.7s`
   
   **`e2e-journey.spec.ts`**
   
   - ✅ E2E: Login Flow › should display login page with all required fields — `1.4s`
   - ✅ E2E: Login Flow › should have Sign In button disabled when fields are empty — `1.3s`
   - ✅ E2E: Login Flow › should enable Sign In when credentials are entered — `1.7s`
   - ✅ E2E: Login Flow › should redirect to dashboard after successful login — `1.7s`
   - ✅ E2E: Login Flow › should display language selector on login page — `1.3s`
   - ✅ E2E: Login Flow › should display API endpoint selector with value — `1.3s`
   - ✅ E2E: Dashboard › should display dashboard summary cards — `1.7s`
   - ✅ E2E: Dashboard › should display system health as Online — `2.0s`
   - ✅ E2E: Dashboard › should display pending approvals section — `1.7s`
   - ✅ E2E: Dashboard › should display loan and savings status distribution charts — `1.7s`
   - ✅ E2E: Dashboard › should display system operational status — `2.1s`
   - ✅ E2E: Dashboard › should have header with business date, render time, and logout — `1.7s`
   - ✅ E2E: Dashboard › should have sidebar toggle button — `2.0s`
   - ✅ E2E: Dashboard › should have global search bar in header — `2.1s`
   - ✅ E2E: Dashboard › should have Guide button in header — `1.7s`
   - ✅ E2E: Dashboard › should have dark mode toggle button — `1.7s`
   - ✅ E2E: Sidebar Navigation › should have all main navigation links — `1.8s`
   - ✅ E2E: Sidebar Navigation › should have Products section with sub-links — `2.3s`
   - ✅ E2E: Sidebar Navigation › should have Transfers section with sub-links — `2.2s`
   - ✅ E2E: Sidebar Navigation › should have Accounting section with sub-links — `2.1s`
   - ✅ E2E: Sidebar Navigation › should have Security section — `1.7s`
   - ✅ E2E: Sidebar Navigation › should have Settings section — `1.7s`
   - ✅ E2E: Sidebar Navigation › should have Organization section — `2.1s`
   - ✅ E2E: Sidebar Navigation › should have System section — `1.7s`
   - ✅ E2E: Sidebar Navigation › should navigate to all major pages via sidebar — `4.0s`
   - ✅ E2E: Offices › should display offices list with table — `2.3s`
   - ✅ E2E: Offices › should have Create Office button — `2.3s`
   - ✅ E2E: Offices › should navigate to office create form — `2.6s`
   - ✅ E2E: Offices › should validate office create form - save disabled when empty — `2.2s`
   - ✅ E2E: Offices › should fill office create form and enable save — `3.0s`
   - ✅ E2E: Offices › should cancel office creation and return to list — `2.2s`
   - ✅ E2E: Offices › should have search input on offices page — `2.0s`
   - ✅ E2E: Offices › should show edit button for each office — `2.4s`
   - ✅ E2E: Offices › should have pagination controls — `2.0s`
   - ✅ E2E: Clients › should display clients list page — `2.4s`
   - ✅ E2E: Clients › should display client data in table — `2.5s`
   - ✅ E2E: Clients › should show ACTIVE status badge — `2.4s`
   - ✅ E2E: Clients › should have Create Client button — `1.9s`
   - ✅ E2E: Clients › should show empty state when no clients exist — `1.9s`
   - ✅ E2E: Clients › should have search input and status filter — `1.9s`
   - ✅ E2E: Clients › should have pagination controls — `1.9s`
   - ✅ E2E: Client Creation › should navigate to client create form — `2.5s`
   - ✅ E2E: Client Creation › should display all required client form fields, across the wizard steps — `3.2s`
   - ✅ E2E: Client Creation › should display optional client form fields, across the wizard steps — `3.2s`
   - ✅ E2E: Client Creation › should have Next disabled until the current step is valid — `2.6s`
   - ✅ E2E: Client Creation › should populate office dropdown from API — `2.5s`
   - ✅ E2E: Client Creation › should fill client form and enable save on the last step — `4.0s`
   - ✅ E2E: Client Creation › should submit client and redirect to clients list — `4.0s`
   - ✅ E2E: Client Creation › should cancel client creation and return to clients list — `2.6s`
   - ✅ E2E: Client Creation › should have add office quick-action button — `2.1s`
   - ✅ E2E: Client Creation › should have help icons for form fields — `2.1s`
   - ✅ E2E: Client Creation › should have calendar buttons for date fields — `2.6s`
   - ✅ E2E: Client Creation › should have pre-filled dates in Submitted On and Activation Date — `2.6s`
   - ✅ E2E: Client Creation › should have Active checkbox checked by default — `2.5s`
   - ✅ E2E: Client Creation › should handle Entity legal form showing fullname field — `3.1s`
   - ✅ E2E: Loan Products Page › should display loan products list page — `2.3s`
   - ✅ E2E: Loan Products Page › should have Create Loan Product button — `1.9s`
   - ✅ E2E: Loan Products Page › should display table with correct headers — `1.9s`
   - ✅ E2E: Loan Products Page › should show empty state when no products exist — `1.9s`
   - ✅ E2E: Loan Products Page › should have search input — `2.3s`
   - ✅ E2E: Loan Products Page › should navigate to loan product create form — `2.5s`
   - ✅ E2E: Savings Products Page › should display savings products list page — `1.9s`
   - ✅ E2E: Other Products Pages › Fixed Deposit Products page loads — `1.9s`
   - ✅ E2E: Other Products Pages › Recurring Deposit Products page loads — `1.9s`
   - ✅ E2E: Other Products Pages › Share Products page loads — `1.9s`
   - ✅ E2E: Other Products Pages › Tax Components page loads — `2.3s`
   - ✅ E2E: Other Products Pages › Tax Groups page loads — `1.8s`
   - ✅ E2E: Other Products Pages › Floating Rates page loads — `1.9s`
   - ✅ E2E: Loans Portfolio › should display loans portfolio page — `2.3s`
   - ✅ E2E: Loans Portfolio › should have Create Loan Account button — `1.9s`
   - ✅ E2E: Loans Portfolio › should display table with correct headers — `1.9s`
   - ✅ E2E: Loans Portfolio › should show empty state when no loans exist — `2.3s`
   - ✅ E2E: Loans Portfolio › should have search input — `1.9s`
   - ✅ E2E: Loans Portfolio › should have pagination controls — `1.9s`
   - ✅ E2E: Header & Global Elements › should display Fineract logo and title in header — `2.0s`
   - ✅ E2E: Header & Global Elements › should display logged-in username — `1.9s`
   - ✅ E2E: Header & Global Elements › should display office name for user — `1.6s`
   - ✅ E2E: Header & Global Elements › should have Logout button — `2.1s`
   - ✅ E2E: Header & Global Elements › should have language selector in header — `1.6s`
   - ✅ E2E: Header & Global Elements › should display render time — `1.8s`
   - ✅ E2E: Header & Global Elements › should display business date — `2.0s`
   
   **`feature-coverage.spec.ts`**
   
   - ✅ Navigation & Sidebar › all main navigation links are visible in sidebar — `2.3s`
   - ✅ Navigation & Sidebar › sidebar navigation routes to correct pages — `3.3s`
   - ✅ Navigation & Sidebar › navigating to /accounting redirects to /accounting/chart-of-accounts — `3.5s`
   - ✅ Navigation & Sidebar › navigating to /organization redirects to /organization/offices — `3.0s`
   - ✅ Navigation & Sidebar › navigating to /system redirects to /system/data-tables — `3.2s`
   - ✅ Navigation & Sidebar › an unknown route keeps its URL and offers recovery actions — `3.4s`
   - ✅ Navigation & Sidebar › header shows logged-in user info — `2.0s`
   - ✅ Navigation & Sidebar › help tour button is visible and interactive — `1.6s`
   - ✅ Navigation & Sidebar › logout button is visible — `1.6s`
   - ✅ Navigation & Sidebar › language selector is present — `1.9s`
   - ✅ Dashboard › dashboard shows key metrics cards — `2.1s`
   - ✅ Dashboard › dashboard shows pending approvals section — `2.0s`
   - ✅ Dashboard › dashboard shows loan and savings status distribution — `2.0s`
   - ✅ Dashboard › dashboard shows system operational status — `2.0s`
   - ✅ Groups › groups page renders with title — `1.8s`
   - ✅ Groups › groups page has create button — `2.4s`
   - ✅ Centers › centers page renders with title — `2.2s`
   - ✅ Centers › centers page has create button — `1.8s`
   - ✅ Organization › offices page loads with list — `2.0s`
   - ✅ Organization › staff page loads — `1.9s`
   - ✅ Organization › funds page loads — `2.3s`
   - ✅ Organization › payment types page loads — `1.9s`
   - ✅ Accounting › chart of accounts loads — `2.2s`
   - ✅ Accounting › journal entries page loads — `2.4s`
   - ✅ Accounting › accounting closures loads — `1.8s`
   - ✅ Accounting › accounting rules loads — `2.2s`
   - ✅ Accounting › financial activity mappings loads — `1.8s`
   - ✅ Accounting › charges page loads — `1.8s`
   - ✅ Security › users page loads — `2.2s`
   - ✅ Security › roles page loads — `1.8s`
   - ✅ Security › audit logs page loads — `2.4s`
   - ✅ Security › leftover audit trails path lands on audits, not the dashboard — `3.5s`
   - ✅ Products - Loan & Savings › loan products page loads — `1.9s`
   - ✅ Products - Loan & Savings › savings products page loads — `1.8s`
   - ✅ Products - Loan & Savings › tax components page loads — `2.3s`
   - ✅ Products - Loan & Savings › tax groups page loads — `1.9s`
   - ✅ Products - Loan & Savings › floating rates page loads — `1.9s`
   - ✅ Products - Loan & Savings › savings accounts page loads — `1.9s`
   - ✅ Settings › global configurations page loads — `1.8s`
   - ✅ Settings › holidays page loads — `2.3s`
   - ✅ Settings › working days page loads — `1.8s`
   - ✅ System › data tables page loads — `1.8s`
   - ✅ System › bulk import page loads — `2.2s`
   - ✅ System › delinquency page loads — `1.9s`
   - ✅ Tellers › tellers page loads with create button — `2.3s`
   - ✅ Transfers › account transfer page loads — `2.0s`
   - ✅ Transfers › standing instructions page loads — `1.8s`
   - ✅ Transfers › SI history page loads — `1.8s`
   - ✅ Embedded Fintech › asset owners page loads — `2.2s`
   
   **`functional-coverage.spec.ts`**
   
   - ✅ Client CRUD Workflow › should complete full client creation flow — Person — `4.0s`
   - ✅ Client CRUD Workflow › should complete full client creation flow — Entity — `3.7s`
   - ✅ Client CRUD Workflow › should cancel client creation and return to list — `2.1s`
   - ✅ Client CRUD Workflow › should disable office and legal form in edit mode — `3.5s`
   - ✅ Client View & Status Transitions › should display client view with correct details — `3.4s`
   - ✅ Client View & Status Transitions › should show actions menu for pending client (status 100) — `3.7s`
   - ✅ Client View & Status Transitions › should show actions menu for active client (status 300) — `3.2s`
   - ✅ Client View & Status Transitions › should show actions menu for closed client (status 600) — `3.3s`
   - ✅ Client View & Status Transitions › should show New Account menu for active client — `3.5s`
   - ✅ Client View & Status Transitions › should navigate from client view to client list via breadcrumb — `3.8s`
   - ✅ Client View & Status Transitions › should navigate back from client view — `4.0s`
   - ✅ Client View Tabs › should display all expected tabs on client view — `3.7s`
   - ✅ Client View Tabs › should switch between client view tabs — `3.6s`
   - ✅ Search & Filter Interactions › should have search input on clients page and accept input — `2.3s`
   - ✅ Search & Filter Interactions › should have office filter on groups page — `2.4s`
   - ✅ Search & Filter Interactions › should have office filter on loans page — `2.3s`
   - ✅ Search & Filter Interactions › should have search input on charges page — `1.9s`
   - ✅ Navigation Flow Verification › should navigate full client lifecycle: list → create → back → list — `2.7s`
   - ✅ Navigation Flow Verification › should navigate from dashboard to all top-level pages via sidebar — `4.1s`
   - ✅ Navigation Flow Verification › should go from loan products → create → back — `2.6s`
   - ✅ Office CRUD › should validate office create form — save disabled when empty — `2.5s`
   - ✅ Office CRUD › should validate office create form — save enabled when filled — `2.5s`
   - ✅ Office CRUD › should cancel office creation — `2.4s`
   - ✅ Organization Create Flows › staff create form loads — `2.1s`
   - ✅ Organization Create Flows › funds create form loads — `2.0s`
   - ✅ Organization Create Flows › payment types create form loads — `2.4s`
   - ✅ Accounting CRUD › accounting closure create form loads — `2.1s`
   - ✅ Accounting CRUD › accounting rule create form loads — `2.0s`
   - ✅ Accounting CRUD › financial activity mapping create form loads — `2.0s`
   - ✅ Accounting CRUD › charge create form loads — `2.1s`
   - ✅ Accounting CRUD › chart of accounts create form loads — `2.4s`
   - ✅ Settings CRUD › global configurations page has editable toggle — `2.2s`
   - ✅ Settings CRUD › holiday create form loads — `2.2s`
   - ✅ Settings CRUD › working days page has save button — `1.9s`
   - ✅ System CRUD › data table create form loads — `2.1s`
   - ✅ System CRUD › delinquency page has create buttons for ranges and buckets — `2.4s`
   - ✅ Security CRUD › role create form loads — `2.3s`
   - ✅ Security CRUD › audit logs search form has date range — `2.2s`
   - ✅ Security CRUD › audit logs list exports the loaded page as CSV — `2.1s`
   - ✅ Reporting — Run Report Flow › should navigate to report and verify report parameters — `3.0s`
   - ✅ Teller CRUD › teller create form loads — `2.6s`
   - ✅ Create Office Dialog from Client Form › should open create office dialog from client create form — `2.4s`
   
   **`global-search-nav-shortcuts.spec.ts`**
   
   - ✅ Global search navigation shortcuts › offers a settings page the entity search cannot return — `2.1s`
   - ✅ Global search navigation shortcuts › navigates to the page behind a shortcut — `2.1s`
   - ✅ Global search navigation shortcuts › keeps the results open across the mousedown that starts a click, so a slow render cannot race the dropdown closed — `2.4s`
   - ✅ Global search navigation shortcuts › withholds a shortcut the user has no permission to reach — `2.9s`
   
   **`global-search-navigation.spec.ts`**
   
   - ✅ Global search navigation › does not query the backend for a single character — `2.8s`
   - ✅ Global search navigation › sends one request for a phrase typed straight through — `3.0s`
   - ✅ Global search navigation › opens the client behind a client result — `2.5s`
   - ✅ Global search navigation › opens the loan behind a loan result — `2.4s`
   - ✅ Global search navigation › opens the savings account behind a savings result — `2.3s`
   - ✅ Global search navigation › clears the query and closes the dropdown after a selection — `2.6s`
   - ✅ Global search navigation › closes the dropdown when focus leaves without a selection — `2.7s`
   - ✅ Global search navigation › shows nothing rather than an empty dropdown when there are no matches — `3.0s`
   
   **`group-detail.spec.ts`**
   
   - ✅ Group detail › custom field tabs expose the app keyboard and panel contract at 1280px — `4.0s`
   - ✅ Group detail › custom field tabs expose the app keyboard and panel contract at 390px — `4.3s`
   - ✅ Group detail › asks for the associations, and shows every member rather than only the active ones — `3.9s`
   - ✅ Group detail › closes a group with the reason id and a Fineract-formatted date — `5.3s`
   - ✅ Group detail › does not offer a client who is already a member, and associates the one it does — `4.5s`
   - ✅ Group detail › unassigns a committee role by the assignment id, not the role id — `4.4s`
   - ✅ Group detail › offers a retry when the group cannot be loaded — `3.3s`
   - ✅ Group detail › says so when no closure reason has been defined — `3.9s`
   
   **`guidance-tour.spec.ts`**
   
   - ✅ the guided tour › highlights the System Status card, not the sidebar, on the dashboard tour — `2.6s`
   - ✅ the guided tour › presents the card as a dialog named and described by its own copy — `2.0s`
   - ✅ the guided tour › announces the step counter as a polite live region — `2.1s`
   - ✅ the guided tour › closes on Escape and hands focus back to the Guide button — `2.1s`
   - ✅ the guided tour › names an unmatched route after itself instead of handing it the dashboard tour — `3.7s`
   - ⏭️ the guided tour at a phone viewport › opens from the overflow menu as a full-width bottom sheet — `1.6s`
   
   **`keyboard-shortcuts.spec.ts`**
   
   - ✅ Alt+C jumps straight to Create Client from anywhere — `2.3s`
   - ✅ Alt+G jumps to Create Group — `2.2s`
   - ✅ Alt+E jumps to Create Center — `1.9s`
   - ✅ Alt+H opens the guidance tour for the current page — `1.6s`
   - ✅ typing in the global search box does not trigger the Create Client shortcut — `2.1s`
   
   **`list-load-failure.spec.ts`**
   
   - ✅ entity-to-entity mapping › renders the rows the endpoint returns, rather than claiming there are none — `3.4s`
   - ✅ entity-to-entity mapping › shows a failure state, not an empty one, when the payload cannot be read — `4.1s`
   - ✅ entity-to-entity mapping › retries and recovers — `3.9s`
   - ✅ report mailing jobs › reads rows out of the paged envelope the endpoint returns — `3.9s`
   - ✅ report mailing jobs › shows a failure state when the request errors — `4.1s`
   
   **`list-pagination.spec.ts`**
   
   - ✅ List pagination › advances through pages and back again — `4.0s`
   - ✅ List pagination › jumps to the last page — `3.9s`
   - ✅ List pagination › returns to the first page when a filter changes — `4.7s`
   - ✅ List pagination › keeps search text when paging and shows the v2 account number — `4.5s`
   - ✅ List pagination › redirects the old search page and exposes only one client navigation item — `5.4s`
   - ✅ List pagination › keeps an account-number search broad and disables unsupported Office sorting — `4.7s`
   - ✅ List pagination › returns to the first page when searching — `4.5s`
   - ✅ Profile › renders the signed-in user rather than hanging on a spinner — `3.4s`
   - ✅ Profile › changes the signed-in user password from the profile screen — `3.9s`
   - ✅ Profile › shows an error when the profile cannot be loaded — `3.7s`
   - ✅ List load failure › reports the failure and reloads when the user retries — `3.5s`
   - ✅ List load failure › calendars: reports the failure and reloads when the user retries — `3.8s`
   - ✅ List load failure › accounting rules: reports the failure and reloads when the user retries — `3.5s`
   
   **`loan-delinquency-actions.spec.ts`**
   
   - ✅ Delinquency pause and resume on a regular loan › shows the dates as dates, and the pause periods under their real fields — `3.4s`
   - ✅ Delinquency pause and resume on a regular loan › pauses delinquency for a period, from the business date — `4.5s`
   - ✅ Delinquency pause and resume on a regular loan › will not take a pause that ends before, or when, it starts — `4.0s`
   - ✅ Delinquency pause and resume on a regular loan › sends nothing when the pause dialog is cancelled — `4.7s`
   - ✅ Delinquency pause and resume on a regular loan › shows the platform’s own reason when it refuses a pause, and stays usable — `4.3s`
   - ✅ Delinquency pause and resume on a regular loan › resumes a pause that is in effect, dated the business date and with no end date — `4.4s`
   - ✅ Delinquency pause and resume on a regular loan › stops offering resume once the pause has been ended — `4.3s`
   - ✅ Delinquency pause and resume on a regular loan › does not offer resume when no pause is in effect — `3.8s`
   - ✅ Delinquency pause and resume on a regular loan › offers neither action without the permission to create a delinquency action — `3.6s`
   - ✅ Delinquency pause and resume on a regular loan › offers the permitted user the actions that permission opens, and no others — `3.5s`
   - ✅ Delinquency pause and resume on a regular loan › offers neither action on a loan that is not active — `3.7s`
   
   **`loan-portfolio-summary.spec.ts`**
   
   - ✅ Loan Portfolio Summary › searching sends entities: loans and shows the grouped results — `3.5s`
   - ✅ Loan Portfolio Summary › Edit Parameters returns from the results view to the filter form — `3.4s`
   - ✅ Loan Portfolio Summary › checking the outstanding-amount filter sends the between min/max values — `3.6s`
   - ✅ Loan Portfolio Summary › switching to a single-value comparison condition sends one value — `4.0s`
   
   **`loan-product-down-payment.spec.ts`**
   
   - ✅ Loan product down payment and tranches › down payment is offered only for a progressive product — `4.2s`
   - ✅ Loan product down payment and tranches › the percentage and auto-repayment appear only once down payment is on — `4.6s`
   - ✅ Loan product down payment and tranches › multi-tranche disbursement reveals its tranche count, on either engine — `3.6s`
   - ✅ Loan product down payment and tranches › submits the down payment and tranche settings it was given — `4.9s`
   - ✅ Loan product down payment and tranches › does not send a down payment on a cumulative product — `5.6s`
   - ✅ Loan product down payment and tranches › income recognition is offered only for a progressive product — `4.1s`
   - ✅ Loan product down payment and tranches › the capitalisation details appear only once it is on — `3.5s`
   - ✅ Loan product down payment and tranches › submits the income recognition settings it was given — `3.8s`
   - ✅ Loan product down payment and tranches › does not send income recognition on a cumulative product — `4.8s`
   - ✅ Loan product down payment and tranches › interest recalculation reveals its mandatory settings only once it is on — `2.6s`
   - ✅ Loan product down payment and tranches › the rest interval appears only when the frequency is not the repayment period — `13.7s`
   - ✅ Loan product down payment and tranches › submits the interest recalculation settings it was given — `3.1s`
   - ✅ Loan product down payment and tranches › does not send recalculation settings once it is switched back off — `2.8s`
   
   **`charge-refund.spec.ts`**
   
   - ✅ refunds the remaining balance of a collected loan charge — `5.3s`
   
   **`client-empty-account-cta.spec.ts`**
   
   - ✅ empty account tabs offer the matching creation action — `5.7s`
   
   **`client-load-error.spec.ts`**
   
   - ✅ shows a not-found state and returns to the list, without an error toast — `3.3s`
   - ✅ offers a retry for a transient failure, and recovers on success — `2.6s`
   
   **`contract-termination.spec.ts`**
   
   - ✅ terminates and undoes a progressive loan contract — `6.8s`
   
   **`loan-schedule-type-gating.spec.ts`**
   
   - ✅ Loan schedule type gating › a cumulative loan offers neither progressive-only tab, and fetches neither — `2.4s`
   - ✅ Loan schedule type gating › a progressive loan shows only the capabilities it actually has — `3.3s`
   - ✅ Loan schedule type gating › fetches buy-down fees for a progressive loan that has no external id — `2.5s`
   - ✅ Loan schedule type gating › a progressive loan with both capabilities shows both — `2.6s`
   - ✅ Loan schedule type gating › a charged-off loan says so and offers the reversal instead — `3.1s`
   - ✅ Loan schedule type gating › a healthy loan offers charge-off and no marker — `3.0s`
   
   **`loan-servicing-gaps.spec.ts`**
   
   - ✅ Loan servicing gaps › edits an interest pause through PUT while preserving its existing dates — `2.9s`
   - ✅ Loan servicing gaps › undo approval sends an empty body, without the locale the platform refuses — `3.7s`
   - ✅ Loan servicing gaps › undo approval carries the reason when one was given — `3.8s`
   - ✅ Loan servicing gaps › undo approval is offered only while the loan is approved — `2.9s`
   - ✅ Loan servicing gaps › the delinquency tab shows the summary the loan carries and the tags it fetches — `3.5s`
   - ✅ Loan servicing gaps › the data-only tabs stay hidden when the loan carries nothing for them — `2.5s`
   - ✅ Loan servicing gaps › each data-only tab appears and renders once the loan carries its data — `3.3s`
   - ✅ Loan servicing gaps › disburse to savings sends the date and amount, with the platform date format — `3.6s`
   - ✅ Loan servicing gaps › disburse to savings is offered only on an approved loan — `3.4s`
   - ✅ Loan servicing gaps › unassign loan officer sends the date, and appears only when one is assigned — `3.3s`
   - ✅ Loan servicing gaps › unassign loan officer is hidden on a loan with no officer — `3.1s`
   - ✅ Loan servicing gaps › undo last disbursal appears only on a multi-disbursal loan, and sends an empty body — `3.8s`
   - ✅ Loan servicing gaps › undo last disbursal is hidden on a single-disbursal loan — `2.9s`
   - ✅ Loan servicing gaps › close as rescheduled is offered on an active loan — `2.9s`
   - ✅ Loan servicing gaps › revising the amounts is offered on an approved loan — `2.9s`
   - ✅ Loan servicing gaps › revising the amounts is hidden before approval — `2.8s`
   - ✅ Loan servicing gaps › revising the approved amount sends the new amount and locale — `3.9s`
   - ✅ Loan servicing gaps › revising the available disbursement amount sends the new amount, including zero — `3.7s`
   
   **`logout-reason-notice.spec.ts`**
   
   - ✅ explains an inactivity sign-out — `1.4s`
   - ✅ explains an expired session, with different wording — `1.2s`
   - ✅ stays silent when the user came to sign in of their own accord — `178ms`
   - ✅ stays silent for a reason it does not recognise, rather than showing a blank notice — `180ms`
   
   **`oidc-login.spec.ts`**
   
   - ✅ identity-provider route on the login page › a deployment that never set the flag sees the screen it always saw — `1.2s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is false — `1.5s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is "true" — `1.3s`
   - ✅ identity-provider route on the login page › does not offer the route when the flag is 1 — `1.3s`
   - ✅ identity-provider route on the login page › offers the route above the password form, which stays in place — `1.2s`
   - ✅ identity-provider route on the login page › says plainly that it is not available yet, and goes nowhere — `1.2s`
   - ✅ identity-provider route on the login page › username and password still sign in when the route is offered — `2.0s`
   - ✅ identity-provider route on the login page › is not offered while a second factor is being asked for — `1.3s`
   
   **`rbac-feature-flag.spec.ts`**
   
   - ✅ RBAC permission gating (rbacEnabled = true) › a limited user does not see permission-gated nav groups — `1.3s`
   - ✅ RBAC permission gating (rbacEnabled = true) › a user with READ_USER sees only the Security entries that permission covers — `1.3s`
   - ✅ RBAC permission gating (rbacEnabled = true) › the Security group fills in as the user is granted each of its permissions — `1.2s`
   - ✅ RBAC permission gating (rbacEnabled = true) › a superuser (ALL_FUNCTIONS) sees all permission-gated groups — `1.7s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › universal institution shows Groups, Centers and Collection Sheet — `1.4s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › commercial bank (cb) hides all group-lending features — `1.4s`
   - ✅ RBAC institution-feature gating (rbacEnabled = true) › credit union (cu) shows Groups but hides Centers and Collection Sheet — `1.4s`
   - ✅ rbacEnabled = false › restores the pre-RBAC behaviour of showing everything — `1.4s`
   - ✅ deployment navigation overrides › removes the entries the deployment names by id, leaving the rest alone — `1.8s`
   - ✅ deployment navigation overrides › ignores a labelKey where an id is required — `1.3s`
   - ✅ deployment navigation overrides › removes them even where RBAC is off — `1.4s`
   
   **`rbac-route-protection.spec.ts`**
   
   - ✅ route authorization › a superuser reaches every sampled route and sees the full navigation — `11.1s`
   - ✅ route authorization › a single-module user is confined to that module — `7.8s`
   - ✅ route authorization › a read-only user gets the lists and not the forms — `9.5s`
   - ✅ route authorization › a user with an empty permission list is refused everywhere and the app still works — `8.5s`
   - ✅ route authorization › a session carrying no permissions field is treated as carrying none — `4.4s`
   - ✅ route authorization › an unrecognised permission code grants nothing — `4.6s`
   - ✅ route authorization › an unauthenticated visitor is asked to sign in, not told they are forbidden — `4.9s`
   - ✅ route authorization › a deployment with RBAC turned off behaves as it did before the guard — `6.6s`
   - ✅ the Access Denied page › says what happened, under a single heading — `2.8s`
   - ✅ the Access Denied page › moves focus to the heading, since the user did not ask to come here — `3.1s`
   - ✅ the Access Denied page › announces itself politely — `2.8s`
   - ✅ the Access Denied page › names the permissions the screen wanted, so the user can ask for them — `2.8s`
   - ✅ the Access Denied page › offers a way back that the user is allowed to take — `3.0s`
   - ✅ the Access Denied page › is reachable by keyboard alone — `2.9s`
   - ✅ permission feedback › a visible nav entry says what the user can do in that module — `1.3s`
   - ✅ permission feedback › a nav entry carries no hint when there is nothing specific to say — `1.4s`
   - ✅ navigation and routes agree › a hidden menu entry is also refused by URL, and a shown one is not — `4.9s`
   - ✅ navigation and routes agree › the create button is withheld from a user whose create route would refuse them — `2.9s`
   
   **`report-enhancements.spec.ts`**
   
   - ✅ Report Enhancements, Pagination, and Help Tour › should run report, show paginated data, and download CSV — `3.4s`
   - ✅ Report Enhancements, Pagination, and Help Tour › should trigger guidance help tour and navigate steps — `2.8s`
   
   **`reporting.spec.ts`**
   
   - ✅ Reporting › should display list of reports — `1.8s`
   - ✅ Reporting › should navigate to run report page — `2.1s`
   
   **`scheduler-jobs.spec.ts`**
   
   - ✅ Scheduler Jobs bulk run › Run Selected is disabled until a job is checked — `2.5s`
   - ✅ Scheduler Jobs bulk run › Select All checks every job, and running confirms then triggers each one — `3.0s`
   - ✅ Scheduler Jobs bulk run › declining the confirmation runs nothing — `3.5s`
   
   **`two-factor-authentication.spec.ts`**
   
   - ✅ two-step verification › asks for a code and lets the user in once it is accepted — `1.4s`
   - ✅ two-step verification › sends the token on every later request — `1.4s`
   - ✅ two-step verification › keeps the user on the step when the code is wrong, and says why — `1.3s`
   - ✅ two-step verification › accepts a correct code after a wrong one — `1.5s`
   - ✅ two-step verification › offers the choice when there is more than one channel — `1.4s`
   - ✅ two-step verification › says so when the account has no channel configured — `1.2s`
   - ✅ two-step verification › returns to the choice when the code could not be sent — `1.2s`
   - ✅ two-step verification › does not let a half-finished session reach the application — `3.5s`
   - ✅ two-step verification › backing out returns to the password form — `1.2s`
   - ✅ two-step verification › a deployment without a second factor signs in exactly as before — `1.4s`
   
   **`working-capital-loan-actions.spec.ts`**
   
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows delinquency action history and submits a new one — `3.6s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows breach action history and submits a new one — `4.8s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows near-breach action history and submits a new one — `3.7s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › attaches and detaches a loan originator — `3.3s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › adds a new charge and waives an existing one — `4.4s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows rate-change history, amortization schedule, and delinquency range tags — `3.0s`
   - ✅ Working Capital loan delinquency, breach and near-breach actions, and originators › marks the loan as fraud, applies a discount, and changes the payment rate — `4.5s`
   
   </details>
   
   <details>
   <summary><b>Slowest 10</b> — what the shard counts should be tuned against</summary>
   
   | Test | Spec | Time |
   | --- | --- | ---: |
   | Runtime accessibility › banner and dashboard content have no blocking violations | `accessibility.spec.ts` | 14.9s |
   | Loan product down payment and tranches › the rest interval appears only when the frequency is not the repayment period | `loan-product-down-payment.spec.ts` | 13.7s |
   | route authorization › a superuser reaches every sampled route and sees the full navigation | `rbac-route-protection.spec.ts` | 11.1s |
   | route authorization › a read-only user gets the lists and not the forms | `rbac-route-protection.spec.ts` | 9.5s |
   | route authorization › a user with an empty permission list is refused everywhere and the app still works | `rbac-route-protection.spec.ts` | 8.5s |
   | route authorization › a single-module user is confined to that module | `rbac-route-protection.spec.ts` | 7.8s |
   | terminates and undoes a progressive loan contract | `contract-termination.spec.ts` | 6.8s |
   | route authorization › a deployment with RBAC turned off behaves as it did before the guard | `rbac-route-protection.spec.ts` | 6.6s |
   | Client form date pickers › stay usable on a second visit to the create form | `client-date-picker-revisit.spec.ts` | 6.2s |
   | empty account tabs offer the matching creation action | `client-empty-account-cta.spec.ts` | 5.7s |
   
   </details>
   
   
   📼 [Download the HTML report, videos and traces](https://github.com/apache/fineract-backoffice-ui/actions/runs/37140999867) — see the `playwright-report-mocked` artifact.
   
   <sub>Generated by [run 37140999867](https://github.com/apache/fineract-backoffice-ui/actions/runs/37140999867) from `2c27faa`. The run executed a fork branch, so treat its contents as unverified.</sub>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal merged PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal commented on PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695#issuecomment-5971708968

   Two things addressed since the last push.
   
   ## Rebased onto current `main`
   
   #694 merged and touched the same import block in `e2e/loan-flows-non-admin-roles.spec.ts` that this branch rewrote — it removed `APIRequestContext`, while this branch replaced the whole block because those helpers moved to `e2e/utils/ui-rbac.ts`. Resolved in favour of this branch's version (`playwrightRequest`, `randomInt`, `Locator`, `API_BASE` and `TENANT_ID` are genuinely unused in that file now), rebased, and force-pushed with an explicit lease.
   
   ## CodeQL: disabling certificate validation — fixed, not dismissed
   
   The scanner was right. `scripts/snapshot-permission-codes.mjs` set `NODE_TLS_REJECT_UNAUTHORIZED = '0'`, which disables validation for the **whole process**. Fineract's e2e container publishes 8443 only with the self-signed certificate it generates for itself, so there is no CA to validate against — but that is not a reason to leave that line in the tree, where it can be copied somewhere it matters.
   
   My first attempt scoped it to a single `https.Agent` and added a guard refusing any non-loopback host, resolving the hostname first so `localhost` could not be pointed elsewhere. That is genuinely narrower — an unvalidated connection could not leave the machine — and I verified it refused `example.com` and accepted `127.0.0.1`.
   
   I threw it away. `rejectUnauthorized: false` is the same sink wherever it sits, and a guard around it is still a bad line with a good comment.
   
   **Splitting the two jobs removes it.** Obtaining the payload is the operator's business and belongs in a shell script — which is where this repo already does exactly this, against exactly this endpoint:
   
   ```bash
   # scripts/e2e-stack.sh:54
   curl -k -s -o /dev/null -w '%{http_code}' --max-time 5 "$HEALTH_URL"
   ```
   
   So `scripts/fetch-permission-codes.sh` fetches and `snapshot-permission-codes.mjs` normalises stdin. **No TLS configuration is left in scanned code at all**, and the pair now works for any way of getting the JSON: the local stack, a real instance with a proper chain (`FINERACT_CA_CERT`, which drops `-k`), or a file saved earlier.
   
   The normaliser is better for being pure — it validates what it is *given* rather than what it fetched. Four failure modes now have their own messages, each verified, with the committed snapshot intact afterwards:
   
   | Input | Message |
   | --- | --- |
   | empty stdin | `Nothing on stdin. Pipe a GET /v1/permissions payload in: …` |
   | an HTML error page | `stdin was not JSON. First 200 characters: …` |
   | a Fineract error object | `Expected an array of permissions. Got: Insufficient privileges` |
   | a truncated payload | `Only 1 codes came back … Refusing to overwrite the snapshot` |
   
   `npm run permissions:snapshot` is unchanged for the caller, and the round trip still produces 723 codes with the five padded ones preserved verbatim.
   
   This was the only such sink in the tree — `grep` for `NODE_TLS_REJECT_UNAUTHORIZED` and `rejectUnauthorized` across `src`, `scripts` and `e2e` now returns nothing outside prose. The e2e suite's own TLS relaxation goes through Playwright's `ignoreHTTPSErrors`, which is a browser-context option rather than a Node TLS setting.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(rbac): gate every control on the permission the platform actually enforces [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal commented on PR #695:
URL: https://github.com/apache/fineract-backoffice-ui/pull/695#issuecomment-5971982202

   Two more things, both found by looking at this pull request's own CI output.
   
   ## The change sequence diagram has never been posted on any pull request
   
   Not a Mermaid problem — the diagram is never delivered. The `diagram` job works and the artifact is there (`pr-comment-diagram`, 874 bytes, on CI run 37140999866), and the Mermaid it renders parses cleanly against mermaid 11's own parser. The publisher skipped it every time and reported success, so the only place it has ever appeared is the job summary.
   
   `pr-comments.yml` downloaded with `pattern: pr-comment-*`, and at the pinned SHA `download-artifact` resolves its destination as
   
   ```
   isSingleArtifactDownload || mergeMultiple || artifacts.length === 1
     ? path
     : path/<artifact name>
   ```
   
   CI renders only the diagram, so the pattern always matched **exactly one** artifact and the file landed at `summaries/pr-diagram.md` with no directory at all. That directory name is how `post-e2e-comments.js` binds a body to the marker it is allowed to post under, so a missing directory is indistinguishable from an artifact that was never uploaded. The E2E summaries were never affected, because that run uploads two — which is why half the mechanism looked healthy for six weeks.
   
   The workflow's own comment had anticipated this case and got the behaviour backwards:
   
   > Each artifact keeps its own directory, so the script can tell one body from another by name … A run that produced only some of them — CI renders the diagram, E2E the summaries — simply has fewer directories, and the script skips what is absent.
   
   With one, there are no directories.
   
   Each artifact is now downloaded **by name, into a directory named after it**, so the layout no longer depends on how many a run happened to produce. Two further defects in the same mechanism went with it:
   
   - The concurrency group was `<this workflow's name>-<commit>` — and `github.workflow` is this workflow's own name, identical whichever run triggered it. CI's publisher and E2E's publisher therefore shared a group, and with `cancel-in-progress` whichever finished second killed the first. Now keyed on `workflow_run.workflow_id` as well; the numeric id rather than the name, because a `pull_request` run builds its workflow from the pull request's own head.
   - Posting nothing logged three "skipping" lines under a green check. It now reports what `summaries/` actually held, and names a root-level `.md` as the collapsed-layout symptom.
   
   `post-e2e-comments.js` had no tests at all. It has seven, including one that pins the agreement between the allow-list, the `upload-artifact` names and the download directories; restoring the pattern download fails it with "an allow-listed artifact is not downloaded". That check matters more than usual here, because **this fix cannot be exercised by the pull request that makes it** — a `workflow_run` workflow always runs the copy on the default branch, so the first real run is the first after merge. If the diagram comment appears on the pull request after this one, it worked.
   
   ## The real-Fineract failure on this branch was mine, and the break was correct
   
   `rbac-dead-end-controls.spec.ts` › *says the list was refused instead of showing an empty table* seeded a user holding `READ_OFFICETRANSACTION` and not `READ_OFFICE`, then asserted the screen loaded and the list request failed — the bare column headers described in §4 above.
   
   Gating the route on `READ_OFFICE` closes that door, so the test was asserting a dead end this branch removes. It now asserts the refusal instead, including that the query string names the code the user is **missing** rather than the one they hold.
   
   The component still carries the refused-load state, correctly, for every other way the request can fail — and no user can reach it through permissions any more. So it moves to a unit test, which also covers a load that merely failed and a payload that is not the array the endpoint claims. The request is driven through `HttpTestingController` rather than by mocking the generated `DefaultService`, which would have put an ADR 0006 boundary violation in a test file.
   
   8/8 in that spec against a running Fineract, first attempt, no retries. Worth noting four of its cases needed two retries on CI and none locally, which is contention on the shared instance rather than the specs.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org