You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fineract.apache.org by am...@apache.org on 2026/10/17 09:31:02 UTC
(fineract-consumer-facing) 01/01: Merge pull request #212 from Aman-Mittal/fix/security-hardening
This is an automated email from the ASF dual-hosted git repository.
Aman-Mittal pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fineract-consumer-facing.git
commit 0415fe2750f1015247eadac8d092c216f90f6b47
Merge: 23f6a5c 1d0f31d
Author: Aman Mittal <32...@users.noreply.github.com>
AuthorDate: Sat Oct 17 15:00:55 2026 +0530
Merge pull request #212 from Aman-Mittal/fix/security-hardening
security: bind one-time codes to a purpose and close the registration identity oracle
.../service/AuthenticationCommandServiceImpl.java | 5 +-
.../service/BeneficiariesCommandServiceImpl.java | 5 +-
.../IdentityVerificationAttemptCounter.java | 104 +++++++++
.../infrastructure/otp/data/OtpPurpose.java | 56 +++++
.../infrastructure/otp/data/PendingOtp.java | 10 +-
.../otp/repository/OtpRepository.java | 39 ++--
.../otp/service/OtpEmailDeliveryService.java | 11 +-
.../infrastructure/otp/service/OtpService.java | 15 +-
.../infrastructure/otp/service/OtpServiceImpl.java | 33 +--
.../RegistrationNotPendingException.java} | 24 +-
.../service/RegistrationCommandServiceImpl.java | 48 +++-
.../service/TransfersCommandServiceImpl.java | 5 +-
.../user/command/service/UserCommandService.java | 10 +
.../command/service/UserCommandServiceImpl.java | 24 +-
.../AuthenticationCommandServiceImplTest.java | 16 +-
.../BeneficiariesCommandServiceImplTest.java | 28 +--
...RateLimitReset.java => ValkeyCounterReset.java} | 25 +-
.../consumer/cucumber/steps/PasswordSteps.java | 53 +++++
.../consumer/cucumber/steps/RegistrationSteps.java | 24 ++
.../IdentityVerificationAttemptCounterTest.java | 122 ++++++++++
.../otp/repository/OtpRepositoryTest.java | 44 +++-
.../otp/service/OtpServiceImplTest.java | 122 ++++++----
.../RegistrationCommandServiceImplTest.java | 257 +++++++++++++++++++++
.../service/TransfersCommandServiceImplTest.java | 34 +--
.../service/UserCommandServiceImplTest.java | 23 +-
.../src/test/resources/features/password.feature | 18 ++
.../test/resources/features/registration.feature | 26 ++-
docs/consumer/architecture/infrastructure.adoc | 4 +-
docs/consumer/features/identity.adoc | 2 +-
docs/consumer/features/otp.adoc | 25 +-
docs/consumer/features/registration.adoc | 29 +--
frontend/public/i18n/en.json | 1 +
frontend/public/i18n/hi.json | 1 +
33 files changed, 1047 insertions(+), 196 deletions(-)